Net::IMAP contains an inefficient algorithm that processes server responses in quadratic time when large numbers of string literals are present. The result is that a malicious IMAP server can craft responses designed to exhaust the client’s CPU resources, causing a denial of service. The weakness is a classic example of inefficient string handling, catalogued as CWE‑407, and does not directly threaten data confidentiality or integrity.

Ruby applications using the Net::IMAP library prior to versions 0.4.24, 0.5.14, or 0.6.4 are affected. These include any project that depends on the ruby:net-imap package with an older gem release, regardless of the surrounding application context.

The CVSS score of 2.3 indicates low severity, but the vulnerability can be exploited remotely by any IMAP server that the client connects to. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the risk of widespread exploitation is unclear. However, the attack vector is inferred to be remote over the network, as a hostile server can send specially crafted responses to trigger the CPU exhaustion attack.