Denial of Service Vulnerability in Net::IMAP for Ruby Packages
Summary
CVE-2025-25186: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Affects ruby3.1 across 3 version ranges.
< 70e3ddd071a94e450b3238570af482c296380b35
< c8c5a643739d2669f0c9a6bb9770d0c045fd74a3
< cb92191b1ddce2d978d01b56a0883b6ecf0b1022
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Net::IMAP is a Ruby library that provides client functionality for the Internet Message Access Protocol (IMAP). It allows Ruby applications to interact with email servers, enabling operations such as retrieving and managing emails. The library is widely used in applications that require email handling capabilities. However, certain versions of Net::IMAP are vulnerable to a denial of service attack due to memory exhaustion, which can be exploited by malicious servers.
Vulnerability Detail
The vulnerability arises from the response parser in Net::IMAP, which can be exploited by a malicious server sending highly compressed 'uid-set' data. This data is automatically processed by the client's receiver thread, leading to potential memory exhaustion. The parser uses 'Range#to_a' to convert 'uid-set' data into arrays of integers without any limitation on the size of the ranges, making it susceptible to denial of service attacks. This issue affects versions 0.3.2 to 0.3.7, and 0.4.0 to 0.4.18, as well as 0.5.0 to 0.5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing a firewall rule to block connections from untrusted servers that may exploit this vulnerability. Additionally, you may limit the size of incoming data packets to mitigate the risk of memory exhaustion.
Conclusion
The CVE-2025-25186 vulnerability in the Net::IMAP library poses a significant risk of denial of service through memory exhaustion. It is crucial for users of affected versions to update to the patched versions to ensure application security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ruby3.1 →
FAQ
CVE-2025-25186 is a vulnerability in the Net::IMAP library for Ruby that allows for denial of service through memory exhaustion.
Versions 0.3.2 to 0.3.7, 0.4.0 to 0.4.18, and 0.5.0 to 0.5.5 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can lead to denial of service, causing your application to become unresponsive due to memory exhaustion.
While updating is the best solution, you can implement firewall rules and limit incoming data sizes as temporary workarounds.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby3.1.
