Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net-imap | rubygems | >= 0.6.0, <= 0.6.4 | 0.6.4.1 |
| net-imap | rubygems | <= 0.5.14 | 0.5.15 |
Miggo AIRoot Cause AnalysisThe vulnerability allows for command injection through non-synchronizing literals in raw data arguments if the IMAP server does not support them. The advisory points to several high-level commands (search, fetch, etc.) being affected. The root cause is the client library's failure to check for server capabilities (LITERAL+, LITERAL-, or IMAP4rev2) before sending this type of data.
Analysis of the patch between the vulnerable version 0.6.4 and the patched version 0.6.4.1 pinpoints the exact location of the fix. Commit 62a0da6d1f78610b15941758db4a28f027a25666 introduces a security validation within the lib/net/imap/command_data.rb file.
The modified function is Net::IMAP.send_literal. The patch adds a crucial block of code that checks if a non-synchronizing literal is allowed by the server (using the new non_sync_literal_allowed? method) before attempting to send it. If the server does not support it, the connection is closed, and an error is raised, effectively stopping the malicious payload from being processed by the server.
During an exploit, user-controlled input passed to a command like search would be processed and eventually passed to send_literal. This function would then, in its vulnerable state, send the malicious non-synchronizing literal to the server. Therefore, Net::IMAP.send_literal is the direct vulnerable function that would appear in a runtime profile when the vulnerability is triggered.
Net::IMAP.send_literallib/net/imap/command_data.rb