Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.
CVSS Details
- CVSS 4.0 Base Score: 6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-net-imap | Dec 1, 2025 | Apr 28, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-irbUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygemsUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2Upgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-default-gemsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-debuginfoUpgrade ruby3.2-bundled-gems-debuginfo | Sep 9, 2025 | Apr 28, 2025 |
| Debian | — | No solution exists | May 15, 2025 | Apr 28, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Aug 13, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Sep 25, 2025 | Aug 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub