Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory     exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious     server can send can send a 'literal' byte count, which is automatically read by the client's receiver     thread. The response reader immediately allocates memory for the number of bytes indicated by the server     response. This should not be an issue when securely connecting to trusted IMAP servers that are well-     behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example,     connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and     0.2.5.(CVE-2025-43857)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory     exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious     server can send can send a 'literal' byte count, which is automatically read by the client's receiver     thread. The response reader immediately allocates memory for the number of bytes indicated by the server     response. This should not be an issue when securely connecting to trusted IMAP servers that are well-     behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example,     connecting to a user supplied hostname).(CVE-2025-43857)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1168 advisory.

    Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory     exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious     server can send can send a literal byte count, which is automatically read by the client's receiver     thread. The response reader immediately allocates memory for the number of bytes indicated by the server     response. This should not be an issue when securely connecting to trusted IMAP servers that are well-     behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example,     connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and     0.2.5. (CVE-2025-43857)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to     versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory     exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious     server can send can send a literal byte count, which is automatically read by the client's receiver     thread. The response reader immediately allocates memory for the number of bytes indicated by the server     response. This should not be an issue when securely connecting to trusted IMAP servers that are well-     behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example,     connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and     0.2.5. (CVE-2025-43857)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
264865	EulerOS 2.0 SP13 : ruby (EulerOS-SA-2025-2150)	Nessus	Huawei Local Security Checks	medium
264863	EulerOS 2.0 SP13 : ruby (EulerOS-SA-2025-2140)	Nessus	Huawei Local Security Checks	medium
264418	EulerOS 2.0 SP12 : ruby (EulerOS-SA-2025-2056)	Nessus	Huawei Local Security Checks	medium
261902	EulerOS 2.0 SP10 : ruby (EulerOS-SA-2025-2112)	Nessus	Huawei Local Security Checks	medium
261895	EulerOS 2.0 SP12 : ruby (EulerOS-SA-2025-2025)	Nessus	Huawei Local Security Checks	medium
261838	EulerOS 2.0 SP10 : ruby (EulerOS-SA-2025-2084)	Nessus	Huawei Local Security Checks	medium
261745	Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-1168)	Nessus	Amazon Linux Local Security Checks	medium
252904	Linux Distros Unpatched Vulnerability : CVE-2025-43857	Nessus	Misc.	high
249312	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2025-1941)	Nessus	Huawei Local Security Checks	medium
249200	EulerOS 2.0 SP11 : ruby (EulerOS-SA-2025-1967)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2025-43857

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

medium

medium