Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS Details
- CVSS 4.0 Base Score: 6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade ruby-develUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-raccUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-rssUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-psychUpgrade rubygem-json | Oct 11, 2026 | Aug 5, 2026 |
| Redhat_linux | — | Upgrade rubygemsUpgrade ruby4.0-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-minitestUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-mysql2Upgrade rubygems-develUpgrade rubygem-racc-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade ruby-libs-debuginfoUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-raccUpgrade rubygem-rakeUpgrade ruby4.0-rubygem-pgUpgrade rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade ruby4.0Upgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade ruby4.0-docUpgrade ruby-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade ruby4.0-develUpgrade rubyUpgrade ruby4.0-debuginfoUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygem-irb | Jul 17, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbsUpgrade ruby4.0Upgrade rubygem-racc-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby4.0-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-raccUpgrade rubygem-jsonUpgrade ruby4.0-develUpgrade ruby | Aug 28, 2026 | Aug 27, 2026 |
| Ubuntu | — | Upgrade ruby3.0Upgrade ruby3.3Upgrade ruby3.2Upgrade libruby3.0Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.7 (Ubuntu Pro)Upgrade libruby3.3 | Jun 30, 2026 | Jun 29, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub