Описание
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
A flaw was found in Net::IMAP, a Ruby library implementing the Internet Message Access Protocol (IMAP) client functionality. A hostile server can exploit a quadratic time complexity issue in the Net::IMAP::ResponseReader when processing large responses containing numerous string literals. This can lead to the client's CPU being exhausted, resulting in a denial of service (DoS) attack.
Отчет
Red Hat has rated this flaw as Moderate because a malicious IMAP server can trigger excessive CPU consumption in applications using the affected Net::IMAP library, resulting in a denial-of-service condition. Successful exploitation requires interaction with a hostile server, and the impact is limited to resource exhaustion of the affected client process. The vulnerability does not allow code execution, privilege escalation, or unauthorized access to data, reducing the overall security impact despite the potential availability impact.
Меры по смягчению последствий
To reduce the risk of a denial of service, ensure that applications using the Net::IMAP library are configured to connect exclusively to trusted IMAP servers. Avoid connecting to untrusted or unverified IMAP services, as a hostile server can exploit this vulnerability. This operational control helps prevent exposure to malicious IMAP response processing.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/zync | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/zync | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/zync-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | ruby4.0 | Fixed | RHSA-2026:33540 | 30.06.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send responses which are crafted to exhaust the client's CPU for a denial of service attack. This issue has been patched in versions 0.4.24, 0.5.14, and 0.6.4.
Net::IMAP implements Internet Message Access Protocol (IMAP) client fu ...
net-imap has quadratic complexity when reading response literals
EPSS
6.5 Medium
CVSS3