{"vulnerability": "cve-2025-25186", "sightings": [{"uuid": "eff0a893-6f06-4b09-a70c-66261535112e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25186", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhtk6r3fgx2x", "content": "", "creation_timestamp": "2025-02-10T16:16:55.934742Z"}, {"uuid": "413629c3-29b7-47a8-b0d6-2bbf1796791b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25186", "type": "published-proof-of-concept", "source": "https://t.me/cvedetector/17565", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-25186 - Apache Net::IMAP Denial of Service Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-25186 \nPublished : Feb. 10, 2025, 4:15 p.m. | 1\u00a0hour, 27\u00a0minutes ago \nDescription : Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser.  At any time while the client is connected, a malicious server can send  can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"10 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-10T18:45:35.000000Z"}, {"uuid": "8f5d7093-668f-4ee8-a04d-3cf7f2fdf091", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-25186", "type": "published-proof-of-concept", "source": "https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69", "content": "", "creation_timestamp": "2025-02-08T00:01:06.000000Z"}, {"uuid": "2ba6c50a-b7c7-404a-9ab8-5851ad9a1cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25186", "type": "seen", "source": "https://t.me/hackeronereports/213", "content": "\ud83c\udfaf New Report #2987782: Possible DoS by memory exhaustion in net/imap \n\ud83d\udd3aSeverity: Medium\n\ud83d\udc7d Reporter: manun\n\ud83d\udcbc Team: Internet Bug Bounty\n\ud83d\udcb5 Bounty: null\n\ud83d\udd50 Submitted: 2025-02-11\n\u23f0 Disclosed: 2025-04-27 13:45:48\n\ud83d\udcdd Summary: The net-imap gem implemented an IMAP client in Ruby. Versions prior to 0.3.8, 0.4.19, and 0.5.6 contained a vulnerability that could lead to denial of service by memory exhaustion. The vulnerability was caused by the response parser using Range#to a to convert uid-set data without limiting the expanded size of the ranges. This vulnerability has been assigned the CVE identifier CVE-2025-25186.\n  @hackeronereports", "creation_timestamp": "2026-09-14T06:00:04.710931Z"}, {"uuid": "ac5eec48-29ed-4275-8074-1d12c106ac13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25186", "type": "seen", "source": "https://t.me/hackeronereports/213", "content": "\ud83c\udfaf New Report #2987782: Possible DoS by memory exhaustion in net/imap \n\ud83d\udd3aSeverity: Medium\n\ud83d\udc7d Reporter: manun\n\ud83d\udcbc Team: Internet Bug Bounty\n\ud83d\udcb5 Bounty: null\n\ud83d\udd50 Submitted: 2025-02-11\n\u23f0 Disclosed: 2025-04-27 13:45:48\n\ud83d\udcdd Summary: The net-imap gem implemented an IMAP client in Ruby. Versions prior to 0.3.8, 0.4.19, and 0.5.6 contained a vulnerability that could lead to denial of service by memory exhaustion. The vulnerability was caused by the response parser using Range#to a to convert uid-set data without limiting the expanded size of the ranges. This vulnerability has been assigned the CVE identifier CVE-2025-25186.\n  @hackeronereports", "creation_timestamp": "2026-09-15T00:00:28.068272Z"}]}