The vulnerability exists in Net::IMAP’s STARTTLS implementation, where a man‑in‑the‑middle attacker can induce the library to report a successful TLS upgrade without actually establishing the encryption. This causes the client to send credentials in cleartext over the network, exposing user identities and passwords to the attacker. The weakness stems from improper handling of server responses and timing validation when negotiating STARTTLS, as identified by CWEs 392, 393, 636, 754, and 841.

Ruby applications that rely on the Net::IMAP gem (ruby:net-imap) and have not applied version updates older than v0.3.10, v0.4.24, v0.5.14, or v0.6.4 are affected. Any system that connects to an IMAP server via STARTTLS using this gem is at risk, regardless of the operating system or hosting environment.

The CVSS score of 7.6 indicates a high severity for an attacker able to position themselves as a MITM, such as on an unsecured Wi‑Fi network or an untrusted corporate proxy. Although the EPSS score is not available, the vulnerability’s nature—requiring only network‑level access to intercept the STARTTLS response—renders it relatively easy to exploit. The issue is not listed in the CISA KEV catalog, but its impact warrants prompt remediation.