Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygemsUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubygem-rssUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade rubygem-raccUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-typeprofUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-test-unit | Jul 4, 2025 | Feb 10, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-libsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gems-debuginfo | Apr 15, 2025 | Feb 10, 2025 |
| Debian | — | Upgrade ruby3.3 | May 15, 2025 | Feb 10, 2025 |
| Oracle_linux | — | Upgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-typeprofUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-rbsUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade ruby-docUpgrade ruby | May 7, 2025 | Feb 10, 2025 |
| Redhat_linux | — | Upgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade ruby-debugsourceUpgrade rubygem-rssUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-bundled-gemsNo solution existsUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debugsourceUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade rubygem-raccUpgrade ruby-docUpgrade rubygem-mysql2 | May 7, 2025 | Feb 10, 2025 |
| Rocky_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-raccUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-rbs-debuginfoUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-psychUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade ruby-develUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-json-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade ruby3.2Upgrade libruby3.2Upgrade ruby3.3Upgrade libruby3.3 | Apr 8, 2025 | Feb 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub