CVE-2025-43857 Details
Description
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.
A denial-of-service vulnerability has been identified in the Ruby Net::IMAP library, which implements Internet Message Access Protocol (IMAP) client functionality. This issue is present in versions through 0.5.6, 0.4.19, 0.3.8, and 0.2.4. The vulnerability arises when the Net::IMAP client reads server responses. A malicious server can exploit this by sending a 'literal' byte count, which the client's receiver thread automatically reads. The response reader allocates memory for the indicated bytes, leading to potential memory exhaustion. While this issue may not occur with trusted IMAP servers, it can affect insecure connections and untrustworthy or compromised servers, especially those connected via user-supplied hostnames.
Users should upgrade to Net::IMAP versions 0.5.7, 0.4.20, 0.3.9, or 0.2.5. Instructions for updating the library can be found in the Net::IMAP repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-405 | Asymmetric Resource Consumption (Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ruby-lang net::imap | < 0.2.5 >= 0.3.0, < 0.3.9 >= 0.4.0, < 0.4.20 >= 0.5.0, < 0.5.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 21, 2025 | Reanalysis | [email protected] |
| May 12, 2025 | Initial Analysis | [email protected] |
| Apr 28, 2025 | New CVE Received | [email protected] |