Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade rubyUpgrade ruby-default-gemsUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-abrt-docUpgrade ruby-docUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade rubygem-psychUpgrade rubygem-rexmlUpgrade rubygems | Jul 4, 2025 | Feb 10, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygemsUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-docUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2Upgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bundler | Apr 15, 2025 | Feb 10, 2025 |
| Debian | — | Upgrade ruby3.3 | May 15, 2025 | Feb 10, 2025 |
| Oracle_linux | — | Upgrade rubygem-minitestUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-raccUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygem-mysql2-docUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade ruby-docUpgrade rubyUpgrade rubygem-mysql2 | May 7, 2025 | Feb 10, 2025 |
| Redhat_linux | — | Upgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-rbsUpgrade ruby-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rakeUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-raccUpgrade rubygem-abrtUpgrade rubygem-io-console-debuginfoUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade ruby-debugsourceNo solution existsUpgrade ruby-bundled-gemsUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-typeprofUpgrade rubygem-jsonUpgrade rubygem-racc-debuginfoUpgrade rubygemsUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-rdocUpgrade ruby-libs-debuginfo | May 7, 2025 | Feb 10, 2025 |
| Rocky_linux | — | Upgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-raccUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libs | Jul 31, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade libruby3.3Upgrade libruby3.2Upgrade ruby3.3Upgrade ruby3.2 | Apr 8, 2025 | Feb 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub