Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.
CVSS Details
- CVSS 4.0 Base Score: 6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-net-imap | Dec 1, 2025 | Apr 28, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2Upgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-libsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-json | Sep 9, 2025 | Apr 28, 2025 |
| Debian | — | No solution exists | May 15, 2025 | Apr 28, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Aug 13, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Sep 25, 2025 | Aug 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub