The vulnerability exists in Net::IMAP’s STARTTLS implementation, where a man‑in‑the‑middle attacker can induce the library to report a successful TLS upgrade without actually establishing the encryption. This causes the client to send credentials in cleartext over the network, exposing user identities and passwords to the attacker. The weakness stems from improper handling of server responses and timing validation when negotiating STARTTLS, as identified by CWEs 325, 392, 393, 636, 754, and 841.

Ruby applications that rely on the Net::IMAP gem (ruby:net-imap) and have not applied version updates older than v0.3.10, v0.4.24, v0.5.14, or v0.6.4 are affected. Any system that connects to an IMAP server via STARTTLS using this gem is at risk, regardless of the operating system or hosting environment.

The CVSS score of 7.6 indicates a high severity for an attacker able to position themselves as a MITM, such as on an unsecured Wi‑Fi network or an untrusted corporate proxy. The EPSS score of <1% indicates a low probability of exploitation in the general population, yet the vulnerability’s nature—requiring only network‑level access to intercept the STARTTLS response—renders it comparatively easy to exploit. The issue is not listed in the CISA KEV catalog, but its impact warrants prompt remediation.