Executive brief
The Ruby Net::IMAP library, which allows applications to communicate with email servers, contains a flaw in how it handles certain command arguments. An attacker providing specially crafted input can cause the application to hang or crash by tricking the email server into misinterpreting commands. This results in a denial-of-service condition where the application becomes unresponsive or fails to process email-related tasks.
Technical details
Net::IMAP fails to properly validate trailing literal-continuation markers in raw string arguments for commands such as SEARCH, FETCH, and SORT. The validation regex incorrectly allows strings ending in '{0}' or '{0+}', which the IMAP server interprets as a literal prefix. This causes the server to absorb the subsequent command as part of the current command's arguments. Consequently, the first command fails with a BadResponseError while the second command (often from a different thread) hangs indefinitely until the connection is closed. This vulnerability is fixed in versions 0.6.4.1 and 0.5.15.
Affected products
- ruby net-imap >= 0.6.0, < 0.6.4.1; < 0.5.15
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD