Most recent entries from all

ALSA-2025:10217 — Moderate: ruby:3.3 security update

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 20 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186) * CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219) * uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2025-25186

Affected: Alpaquita:stream: ruby-net-imap

BREW-mailcatcher-CVE-2025-25186 — Possible DoS by memory exhaustion in net-imap

Affected: Homebrew: mailcatcher

### Summary There is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges.

### Details IMAP's `uid-set` and `sequence-set` formats can compress ranges of numbers, for example: `"1,2,3,4,5"` and `"1:5"` both represent the same set. When `Net::IMAP::ResponseParser` receives `APPENDUID` or `COPYUID` response codes, it expands each `uid-set` into an array of integers. On a 64 bit system, these arrays will expand to 8 bytes for each number in the set. A malicious IMAP server may send specially crafted `APPENDUID` or `COPYUID` responses with very large `uid-set` ranges.

The `Net::IMAP` client parses each server response in a separate thread, as soon as each responses is received from the server. This attack works even when the client does not handle the `APPENDUID` or `COPYUID` responses.

Malicious inputs:

```ruby # 40 bytes expands to ~1.6GB: "* OK [COPYUID 1 1:99999999 1:99999999]\r\n"

# Worst *valid* input scenario (using uint32 max), # 44 bytes expands to 64GiB: "* OK [COPYUID 1 1:4294967295 1:4294967295]\r\n"

# Numbers must be non-zero uint32, but this isn't validated. Arrays larger than # UINT32_MAX can be cre…

certfr-2025-avi-0622 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2025-avi-0622

EUVD-2026-214879

fkie_cve-2025-25186

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.

GHSA-7fc5-f82f-cx69 — Possible DoS by memory exhaustion in net-imap

Affected: RubyGems: net-imap

Malicious inputs:

```ruby # 40 bytes expands to ~1.6GB: "* OK [COPYUID 1 1:99999999 1:99999999]\r\n"

# Worst *valid* input scenario (using uint32 max), # 44 bytes expands to 64GiB: "* OK [COPYUID 1 1:4294967295 1:4294967295]\r\n"

# Numbers must be non-zero uint32, but this isn't validated. Arrays larger than # UINT32_MAX can be cre…

msrc_CVE-2025-25186 — Net::IMAP vulnerable to possible DoS by memory exhaustion

msrc_CVE-2025-25186

OESA-2025-1195 — ruby security update

Affected: openEuler:24.03-LTS: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):

RHSA-2025:10217 — Red Hat Security Advisory: ruby:3.3 security update

net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion CGI: Denial of Service in CGI::Cookie.parse uri: userinfo leakage in URI#join, URI#merge and URI#+

RHSA-2025:3906 — Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.13

net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion go-jose: Go JOSE's Parsing Vulnerable to Denial of Service rack: rubygem-rack: Local File Inclusion in Rack::Static golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

UBUNTU-CVE-2025-25186

Affected: Ubuntu:24.04:LTS: ruby3.2