CVE-2025-25186

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.

• CWE-400
• CWE-405
• CWE-409
• CWE-770
• CWE-789
• CWE-1287

• https://github.com/ruby/net-imap/commit/70e3ddd071a94e450b3238570af482c296380b35
• https://github.com/ruby/net-imap/commit/c8c5a643739d2669f0c9a6bb9770d0c045fd74a3
• https://github.com/ruby/net-imap/commit/cb92191b1ddce2d978d01b56a0883b6ecf0b1022
• https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69

Published

Feb 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25180Software installed and run as a non-privileged user may cond…7.8
• CVE-2025-25181A SQL injection vulnerability in timeoutWarning.asp in Advan…7.5
• CVE-2025-25182Stroom is a data processing, storage and analysis platform. …9.4
• CVE-2025-25183vLLM is a high-throughput and memory-efficient inference and…2.6
• CVE-2025-25184Rack provides an interface for developing web applications i…6.5
• CVE-2025-25185GPT Academic provides interactive interfaces for large langu…7.5
• CVE-2025-25187Joplin is a free, open source note taking and to-do applicat…5.4
• CVE-2025-25188Hickory DNS is a Rust based DNS client, server, and resolver…5.7
• CVE-2025-25189The ZOO-Project is an open source processing platform. A ref…5.5
• CVE-2025-2519The Sreamit theme for WordPress is vulnerable to arbitrary f…6.5
• CVE-2025-25190The ZOO-Project is an open source processing platform. The Z…5.5
• CVE-2025-25191Group-Office is an enterprise CRM and groupware tool. This S…5.4