CVE-2025-43857

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ruby/net-imap/pull/442	Issue Tracking Patch
https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462	Patch
https://github.com/ruby/net-imap/pull/445	Issue Tracking Patch
https://github.com/ruby/net-imap/pull/446	Issue Tracking Patch
https://github.com/ruby/net-imap/pull/447	Issue Tracking Patch
https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*
	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*
	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*
	cpe:2.3:a:ruby-lang:net\:\:imap::::::ruby::*

History

12 May 2025, 19:36

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-28 16:15

Updated : 2025-05-12 19:36

NVD link : CVE-2025-43857

Mitre link : CVE-2025-43857

CVE.ORG link : CVE-2025-43857

JSON object : View

Products Affected

ruby-lang

net\

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-405

Asymmetric Resource Consumption (Amplification)

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2025-43857", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-28T16:15:33.440", "references": [{"url": "https://github.com/ruby/net-imap/pull/442", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/pull/444/commits/0ae8576c1a90bcd9573f81bdad4b4b824642d105#diff-53721cb4d9c3fb86b95cc8476ca2df90968ad8c481645220c607034399151462", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/pull/445", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/pull/446", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/pull/447", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/net-imap/security/advisories/GHSA-j3g3-5qv5-52mj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-405"}, {"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-789"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a \"literal\" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5."}, {"lang": "es", "value": "Net::IMAP implementa la funcionalidad de cliente del Protocolo de Acceso a Mensajes de Internet (IMAP) en Ruby. En versiones anteriores a la 0.5.7, 0.4.20, 0.3.9 y 0.2.5, exist\u00eda la posibilidad de denegaci\u00f3n de servicio por agotamiento de memoria al leer las respuestas del servidor. Mientras el cliente est\u00e9 conectado, un servidor malicioso puede enviar un recuento literal de bytes, que el hilo receptor del cliente lee autom\u00e1ticamente. El lector de la respuesta asigna inmediatamente memoria para la cantidad de bytes indicada por la respuesta del servidor. Esto no deber\u00eda ser un problema al conectarse de forma segura a servidores IMAP confiables y con buen comportamiento. Puede afectar a conexiones inseguras y servidores con errores, no confiables o comprometidos (por ejemplo, al conectarse a un nombre de host proporcionado por el usuario). Este problema se ha corregido en las versiones 0.5.7, 0.4.20, 0.3.9 y 0.2.5."}], "lastModified": "2025-05-12T19:36:55.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "A3CA044E-A527-4D63-8811-2A879D57595E", "versionEndExcluding": "0.2.5"}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "D4564036-BD61-4839-B08A-770C905618C4", "versionEndExcluding": "0.3.9", "versionStartIncluding": "0.3.0"}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "7392FFDA-CCC8-4CB2-8731-5B5A3F15A0E3", "versionEndExcluding": "0.4.20", "versionStartIncluding": "0.4.0"}, {"criteria": "cpe:2.3:a:ruby-lang:net\\:\\:imap:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "BC238214-55BF-4EBA-A893-EDBB5E34A728", "versionEndExcluding": "0.5.7", "versionStartIncluding": "0.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}