The vulnerability exists in Net::IMAP versions 0.4.0 through before 0.4.24, 0.5.0 through before 0.5.14, and 0.6.0 through before 0.6.4. When an IMAP client authenticates with SCRAM‑SHA1 or SCRAM‑SHA256, a malicious server can cause a denial‑of‑service by sending a very large iteration count value. The client then performs excessive cryptographic iterations, consuming CPU and memory until the process becomes unresponsive or crashes. The weakness is related to CWE‑1322 (Improper Validation of Cryptographic Parameters), CWE‑770 (Allocation of Resources on Demand Without Limits), and CWE‑606 (Unchecked Input for Loops).

Ruby Net::IMAP clients in the Ruby net‑imap library—specifically version ranges 0.4.0 to 0.4.23, 0.5.0 to 0.5.13, and 0.6.0 to 0.6.3—are affected. The issue has been patched in releases 0.4.24, 0.5.14, and 0.6.4, and later versions are safe.

The CVSS score is 6, indicating a medium severity. EPSS score is 0.00066 (<1%), indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an untrusted IMAP server that an attacker controls; by sending a high iteration count during SCRAM authentication, the attacker forces the client to expend an unreasonable amount of CPU time, leading to a denial of service. The exploit requires no prior compromise of the client and only depends on the authenticity of the server side of the conversation.