Denial of Service in Ruby's Net::IMAP Client
CVE-2025-25186
What is CVE-2025-25186?
The Net::IMAP library in Ruby is susceptible to a denial of service attack due to a flaw in its response parser. Specifically, versions 0.3.2 through 0.3.7, as well as 0.4.0 through 0.4.18, and 0.5.0 through 0.5.5, allow a malicious server to send highly compressed uid-set data. This data can cause memory exhaustion as the response parser does not impose limits on the size of the expanded ranges when converting uid-set into arrays of integers. Users are encouraged to upgrade to versions 0.3.8, 0.4.19, 0.5.6 or later for protection against this vulnerability. For configuration details and backward compatibility guidance, refer to the GitHub Security Advisory.
Affected Version(s)
net-imap >= 0.3.2, < 0.3.8 < 0.3.2, 0.3.8
net-imap >= 0.4.0, < 0.4.19 < 0.4.0, 0.4.19
net-imap >= 0.5.0, < 0.5.6 < 0.5.0, 0.5.6
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved