PT-2026-48341 · Rubygems · Net::Imap
CVSS v4.0
2.1
Low
| Vector | AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Net::IMAP versions prior to 0.5.15
Net::IMAP versions prior to 0.6.5
Description
Several commands in the Net::IMAP Ruby client accept raw string arguments that are only validated to prevent CRLF injection and are then sent verbatim. An incorrect regular expression in the trailing-marker check fails to match
{0} or {0+}, allowing attacker-controlled strings ending in these markers to pass validation. When these arguments are sent, the server interprets the trailing CRLF as part of a literal prefix, causing the next command sent by the client to be absorbed as a continuation of the first. This results in the first command eventually failing and the second command hanging until the connection is closed, potentially leading to a denial of service through unexpected crashes and timeouts. This issue is particularly impactful in multi-threaded environments.The affected components include:
- The
criteriavariable for the#searchand#uid searchendpoints. - The
search keysvariable for the#sort,#thread,#uid sort, and#uid threadendpoints. - The
attrvariable for the#fetchand#uid fetchendpoints.
Recommendations
Update to version 0.5.15 or 0.6.5.
As a temporary workaround, validate that user input provided to the affected command arguments does not end with the
} character.
Implement Timeout or other standard strategies for managing slow connections and misbehaving servers to mitigate the effects of hanging commands.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Net::Imap