CVE-2025-43857: ruby net-imap Uncontrolled Resource Consumption

Vulnerability summary

CVE-2025-43857 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in ruby net-imap. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.5% of scored vulnerabilities.

Timeline

1. 28-04-2025
   PublishedVulnerability first disclosed.
2. 28-04-2025
   Last modifiedVulnerability information updated.

Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-405Asymmetric Resource Consumption (Amplification)The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.