Log in Start free

Vulnerability · Published Apr 28, 2025 · Assigned by GitHub_M

CVE-2025-43857net-imap rubygem vulnerable to possible DoS by memory exhaustion

Medium 6.0

In plain English

A medium-severity uncontrolled resource consumption in net-imap from ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.5%top 57.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20ruby-net-imap0.4.22-r0ALPINE-CVE-2025-43857
Alpine:v3.21ruby-net-imap0.4.22-r0ALPINE-CVE-2025-43857
Debian:12ruby3.1no fix listedDEBIAN-CVE-2025-43857
Debian:13ruby3.3no fix listedDEBIAN-CVE-2025-43857
Debian:14ruby3.3no fix listedDEBIAN-CVE-2025-43857
RubyGemsnet-imap0.2.5GHSA-j3g3-5qv5-52mj
RubyGemsnet-imap0.5.7GHSA-j3g3-5qv5-52mj
RubyGemsnet-imap0.4.20GHSA-j3g3-5qv5-52mj
RubyGemsnet-imap0.3.9GHSA-j3g3-5qv5-52mj
Ubuntu:24.04:LTSjrubyno fix listedUBUNTU-CVE-2025-43857
Ubuntu:25.10jrubyno fix listedUBUNTU-CVE-2025-43857
Ubuntu:26.04:LTSjrubyno fix listedUBUNTU-CVE-2025-43857
Ubuntu:26.10jrubyno fix listedUBUNTU-CVE-2025-43857
Ubuntu:22.04:LTSruby3.0no fix listedUBUNTU-CVE-2025-43857
Ubuntu:24.04:LTSruby3.2no fix listedUBUNTU-CVE-2025-43857
Ubuntu:25.10ruby3.3no fix listedUBUNTU-CVE-2025-43857
Ubuntu:26.04:LTSruby3.3no fix listedUBUNTU-CVE-2025-43857
Ubuntu:26.10ruby3.3no fix listedUBUNTU-CVE-2025-43857

Affected products (as reported)

VendorProductVersions
ruby net-imap >= 0.5.0, < 0.5.7>= 0.4.0, < 0.4.20>= 0.3.0, < 0.3.9>= 0, < 0.2.5

Weakness: CWE-400, CWE-770, CWE-789, CWE-405 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References