ruby net-imap up to 0.3.7/0.4.18/0.5.5 Net::IMAP resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, was found in ruby net-imap up to 0.3.7/0.4.18/0.5.5. This vulnerability affects the function Net::IMAP. The manipulation results in resource consumption. This vulnerability is reported as CVE-2025-25186. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ruby net-imap up to 0.3.7/0.4.18/0.5.5. Affected is the function Net::IMAP. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.

The advisory is available at github.com. This vulnerability is traded as CVE-2025-25186 since 02/03/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 233968 (Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Ruby vulnerabilities (USN-7418-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.3.8, 0.4.19 or 0.5.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (233968). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• ruby

Name

• net-imap

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 0.3.4
• 0.3.5
• 0.3.6
• 0.3.7
• 0.4.0
• 0.4.1
• 0.4.2
• 0.4.3
• 0.4.4
• 0.4.5
• 0.4.6
• 0.4.7
• 0.4.8
• 0.4.9
• 0.4.10
• 0.4.11
• 0.4.12
• 0.4.13
• 0.4.14
• 0.4.15
• 0.4.16
• 0.4.17
• 0.4.18
• 0.5.0
• 0.5.1
• 0.5.2
• 0.5.3
• 0.5.4
• 0.5.5

License

• open-source

Website

• Product: https://github.com/ruby/net-imap/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion