{"uuid": "ac5eec48-29ed-4275-8074-1d12c106ac13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25186", "type": "seen", "source": "https://t.me/hackeronereports/213", "content": "\ud83c\udfaf New Report #2987782: Possible DoS by memory exhaustion in net/imap \n\ud83d\udd3aSeverity: Medium\n\ud83d\udc7d Reporter: manun\n\ud83d\udcbc Team: Internet Bug Bounty\n\ud83d\udcb5 Bounty: null\n\ud83d\udd50 Submitted: 2025-02-11\n\u23f0 Disclosed: 2025-04-27 13:45:48\n\ud83d\udcdd Summary: The net-imap gem implemented an IMAP client in Ruby. Versions prior to 0.3.8, 0.4.19, and 0.5.6 contained a vulnerability that could lead to denial of service by memory exhaustion. The vulnerability was caused by the response parser using Range#to a to convert uid-set data without limiting the expanded size of the ranges. This vulnerability has been assigned the CVE identifier CVE-2025-25186.\n  @hackeronereports", "creation_timestamp": "2026-09-15T00:00:28.068272Z"}