Denial of Service Vulnerability in Net::IMAP of Ruby 3.3 - Memory Exhaustion Risk
Summary
DEBIAN-CVE-2025-25186: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Affects ruby3.3 versions < 3.3.8-1. Fixed in 3.3.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby 3.3 is a version of the Ruby programming language that includes various libraries and modules for building applications. One of these libraries is Net::IMAP, which implements Internet Message Access Protocol (IMAP) client functionality. This library allows Ruby applications to interact with email servers using the IMAP protocol. However, a vulnerability exists in versions prior to 3.3.8, where the response parser can be exploited to cause memory exhaustion, leading to a denial of service.
Vulnerability Detail
The vulnerability arises from the way Net::IMAP handles uid-set data sent by a malicious server. When connected to an IMAP server, the client can receive highly compressed uid-set data that is automatically processed by the receiver thread. The response parser uses Range#to_a to convert this uid-set data into arrays of integers without any limitation on the size of the ranges. This can lead to excessive memory consumption, potentially crashing the application or making it unresponsive. The affected versions are 0.3.2 and prior to 0.3.8, 0.4.19, and 0.5.6.
How To Fix
Minimum fixed version
3.3.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the connections to trusted IMAP servers only, or implement network-level controls to filter out potentially malicious responses. However, the best solution is to update to the patched version as soon as possible.
Conclusion
The vulnerability in Ruby 3.3's Net::IMAP library poses a significant risk of denial of service due to memory exhaustion. It is crucial for users to update to the latest patched version to ensure their applications remain secure. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for ruby3.3 →
FAQ
The vulnerability allows a malicious server to send specially crafted uid-set data that can exhaust memory resources, leading to a denial of service.
Versions 0.3.2 and prior to 0.3.8, 0.4.19, and 0.5.6 of the Net::IMAP library are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the ruby3.3 package to version 3.3.8-1 or higher to mitigate the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using just a manifest file. It helps developers keep their applications secure without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby3.3.
