Skip to content
Fencer Vulns
medium 6.5

CVE-2025-43857 json

net-imap rubygem vulnerable to possible DoS by memory exhaustion

published 2025-04-28 18 mo ago modified 2026-09-10 1 mo ago also GHSA-j3g3-5qv5-52mj , EUVD-2025-12559

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

Patch / fix

  • rubygems net-imap 0.2.5, 0.3.9, 0.4.20, 0.5.7
  • ruby-lang net::imap 0.2.5, 0.3.9, 0.4.20, 0.5.7
  • ruby-net-imap Alpine 3.21, Alpine 3.20 0.4.22-r0

alpine advisories ALPINE-CVE-2025-43857

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-43857 updated cvss 6.5

net-imap: net-imap rubygem vulnerable to possible DoS by memory exhaustion

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/fluentd-rhel9 Red Hat 3scale API Management Platform 2 3scale-amp2/zync-rhel9 Red Hat Enterprise Linux 8 ruby, ruby-irb, rubygems, ruby-libs, rubygem-pg, rubygem-irb, +25 more Red Hat Enterprise Linux 9 ruby, rubygems, ruby-libs, rubygem-irb, rubygem-rbs, rubygem-rss, +13 more Red Hat Enterprise Linux 10 ruby
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
rubygems net-imap
>=0.5.0, <0.5.7
>=0.4.0, <0.4.20
>=0.3.0, <0.3.9
<0.2.5
0.5.7
0.4.20
0.3.9
0.2.5

Affected products

  • ruby net-imap

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-789 Memory Allocation with Excessive Size Value
  • CWE-405 Asymmetric Resource Consumption (Amplification)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.