Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. From versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, and 0.6.0 to before 0.6.4, when authenticating a connection with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack on the client process by sending a big iteration count value. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
CVSS Details
- CVSS 4.0 Base Score: 6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade ruby-debugsourceUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-io-console-debuginfoUpgrade rubygem-minitestUpgrade ruby4.0-debugsourceUpgrade ruby-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-racc-debuginfoUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-irbUpgrade ruby4.0-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade ruby4.0-rubygem-pgUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade ruby4.0-develUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pgUpgrade ruby4.0Upgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade ruby4.0-docUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfo | Jul 17, 2026 | May 9, 2026 |
| Rocky_linux | — | Upgrade rubygem-raccUpgrade ruby4.0-debuginfoUpgrade rubyUpgrade ruby4.0Upgrade rubygem-rbsUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2Upgrade ruby4.0-develUpgrade rubygem-jsonUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade ruby4.0-debugsourceUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debugsource | Aug 28, 2026 | Aug 27, 2026 |
| Ubuntu | — | Upgrade libruby3.2Upgrade libruby3.3Upgrade ruby2.7 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby3.0Upgrade libruby3.0Upgrade ruby3.3Upgrade libruby2.7 (Ubuntu Pro) | Jun 30, 2026 | Jun 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub