Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS Details
- CVSS 4.0 Base Score: 2.3 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygem-rexmlUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-rakeUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade rubygem-raccUpgrade rubygem-rdocUpgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-bundler | Jul 2, 2026 | Jun 30, 2026 |
| Redhat_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade ruby4.0-debuginfoUpgrade rubygem-irbUpgrade ruby4.0-rubygem-pgUpgrade ruby4.0Upgrade rubygem-mysql2-debuginfoUpgrade ruby4.0-develUpgrade rubygem-mysql2-docUpgrade ruby4.0-debugsourceUpgrade rubygem-raccUpgrade rubyUpgrade rubygem-pg-debugsourceUpgrade ruby-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rdocUpgrade ruby-libs-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrtUpgrade ruby-default-gemsUpgrade rubygem-rbsUpgrade ruby4.0-docUpgrade rubygem-racc-debuginfoUpgrade rubygem-pgUpgrade rubygem-rexmlUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygem-rssUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade rubygem-rbs-debuginfo | Jul 2, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-rbsUpgrade ruby4.0-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-raccUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pgUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0Upgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-pgUpgrade ruby4.0-develUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade ruby4.0-debugsource | Jul 3, 2026 | Jul 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub