CVE-2025-43857

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

Reserved 2025-04-17 | Published 2025-04-28 | Updated 2025-04-28 | Assigner GitHub_M

Problem types

CWE-400: Uncontrolled Resource Consumption

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-789: Memory Allocation with Excessive Size Value

CWE-405: Asymmetric Resource Consumption (Amplification)

Product status

>= 0.5.0, < 0.5.7
affected

>= 0.4.0, < 0.4.20
affected

>= 0.3.0, < 0.3.9
affected

>= 0, < 0.2.5
affected

References

github.com/...t-imap/security/advisories/GHSA-j3g3-5qv5-52mj

github.com/ruby/net-imap/pull/442

github.com/...mmits/0ae8576c1a90bcd9573f81bdad4b4b824642d105

github.com/ruby/net-imap/pull/445

github.com/ruby/net-imap/pull/446

github.com/ruby/net-imap/pull/447

cve.org (CVE-2025-43857)

nvd.nist.gov (CVE-2025-43857)

Download JSON