Denial of Service Vulnerability in Net::IMAP for Ruby Packages
Summary
CVE-2025-43857: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Affects ruby3.1 versions < c5a35d29ff9e77a4d0b184a7eaf90314cd4acb59. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Net::IMAP is a Ruby library that provides client functionality for the Internet Message Access Protocol (IMAP). It allows Ruby applications to interact with email servers, enabling operations such as retrieving and managing emails. This library is widely used in applications that require email handling capabilities. However, prior to specific versions, it is susceptible to a denial of service attack due to improper handling of server responses, which can lead to memory exhaustion.
Vulnerability Detail
The vulnerability arises from the way Net::IMAP reads server responses. When connected to an IMAP server, a malicious server can send a 'literal' byte count that the client automatically reads. The response reader allocates memory based on the byte count provided by the server, which can be exploited by an attacker to exhaust the client's memory resources. This issue is particularly concerning when connecting to untrusted or compromised servers, as it can lead to service disruption and application crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider using a trusted IMAP server or implementing additional security measures to validate server responses. Avoid connecting to user-supplied hostnames to mitigate the risk of connecting to malicious servers.
Conclusion
The CVE-2025-43857 vulnerability in the Net::IMAP library poses a significant risk of denial of service through memory exhaustion. It is crucial for developers to update their Ruby packages to the patched versions to mitigate this risk. Additionally, using trusted servers and implementing security measures can help protect applications until updates can be applied.
See every vulnerability recorded for ruby3.1 →
FAQ
CVE-2025-43857 is a vulnerability in the Net::IMAP library for Ruby that can lead to denial of service due to memory exhaustion when reading server responses.
Versions prior to 0.5.7, 0.4.20, 0.3.9, and 0.2.5 of the Net::IMAP library are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, causing the application to crash or become unresponsive due to memory exhaustion.
As a temporary measure, use trusted IMAP servers and avoid connecting to untrusted or user-supplied hostnames to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for ruby3.1.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
