Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2025-25186 Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.

Produits et versions touchés

Produit Versions touchées Corrigé en
net-imap 0.5 0.5.0 → < 0.5.6 0.5.6
net-imap 0.4 0.4.0 → < 0.4.19 0.4.19
net-imap 0.3 0.3.2 → < 0.3.8 0.3.8

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de net-imap

Les 10 CVE de net-imap →
CVE-2026-47242 Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby 5.8 Moyenne CVE-2026-47240 Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby 5.8 Moyenne CVE-2026-47241 Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby 2.1 Faible CVE-2026-42258 Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby 5.8 Moyenne
Suivre cette CVE