Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net-imap | rubygems | >= 0.6.0, <= 0.6.4 | 0.6.4.1 |
| net-imap | rubygems | <= 0.5.14 | 0.5.15 |
Miggo AIRoot Cause AnalysisThe vulnerability is a denial of service in the net-imap library for Ruby. The root cause is an incomplete regular expression in the Net::IMAP::RawData.validate method. This method is responsible for validating raw string arguments passed to several IMAP commands to prevent command injection and other attacks.
The faulty regex, /~?\{[1-9]\d*\+?\}\z/n, was intended to block strings that end with a literal continuation marker (e.g., {123}). However, it failed to match markers for zero-length literals, such as {0} or {0+}. An attacker could exploit this by sending a malicious string ending with {0} as an argument to commands like search, uid_search, fetch, uid_fetch, sort, uid_sort, thread, or uid_thread.
The net-imap client would send this string to the server, followed by a CRLF to terminate the command. The server, seeing the {0} marker, would interpret the CRLF as part of the literal and wait for 0 bytes of data, effectively absorbing the next command sent by the client. This desynchronization of the command stream causes the client to hang, leading to a denial of service.
The patch, identified in commit d6ddd294c588578f6d8dad588716c62f424af2f7, corrects the regular expression in Net::IMAP::RawData.validate to /\{\d+\+?\}\z/n. This new regex correctly identifies all numeric literal markers, including zero-length ones, thus preventing the vulnerability. The primary vulnerable function is Net::IMAP::RawData.validate, as this is where the flawed logic resided.
Net::IMAP::RawData.validatelib/net/imap/command_data.rb