CVE-2025-43857 - CVE House
Back to Database
Status published Medium CVE-2025-43857

net-imap rubygem vulnerable to possible DoS by memory exhaustion

Vulnerability Description

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-43857

Credits & Attribution

No credits recorded in the NVD database.

References

More from ruby

View All →
CVE-2025-61594
URI Credential Leakage Bypass over CVE-2025-27221
Low 2.1
CVE-2025-58767
REXML has a DoS condition when parsing malformed XML file
Low 1.2
CVE-2025-27788
Ruby JSON Parser has Out-of-bounds Read
High 7.5
CVE-2025-25186
Net::IMAP vulnerable to possible DoS by memory exhaustion
Medium 6.5
CVE-2024-49761
REXML ReDoS vulnerability
Medium 6.6

Affected Vendor

Affected Software

net-imap
Vulnerable Versions:
>= 0.5.0, < 0.5.7, >= 0.4.0, < 0.4.20, >= 0.3.0, < 0.3.9, >= 0, < 0.2.5

Timeline

Official Publish: April 28th, 2025
Last Modified: April 28th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-400 CWE-770 CWE-789 CWE-405

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery