Net::IMAP is a client library in Ruby that communicates with IMAP servers. The issue stems from how the library handles non‑synchronizing literals in several commands such as #search, #uid_search, #sort, #thread and #fetch. When an IMAP server does not support these literals, the literal terminator can be interpreted as a CRLF sequence, allowing the contents of the literal to be parsed as new IMAP commands. This bypasses the intended validation and permits a CRLF‑based command injection. An attacker able to supply a crafted literal can cause the Ruby client to send arbitrary IMAP commands to the server. Depending on the commands used, the attacker can read, delete or modify mail, alter mailbox state, or trigger a denial of service, thereby compromising confidentiality, integrity or availability.

The vulnerable code resides in the Net::IMAP Ruby gem that provides IMAP client functionality. Systems using Net::IMAP versions prior to 0.6.5 in the 0.6.x line or prior to 0.5.15 in the 0.5.x line are exposed. Organizations that incorporate this gem into applications or scripts that construct raw IMAP commands, especially when connecting to servers that do not advertise support for non‑synchronizing literals, may be impacted.

The vulnerability carries a CVSS score of 5.8, indicating moderate severity. There is no EPSS score available, and the flaw is not listed in the CISA KEV catalogue. Exploitation requires that the target IMAP server lacks support for non‑synchronizing literals, meaning an attacker would need to control or manipulate the server or the network path between client and server. The potential for commandeering mailbox contents or disrupting service suggests that the risk to an affected system is significant, though the condition for exploitation limits its spread to environments where the server is misconfigured or legacy. Updating to the fixed gem versions removes the vulnerability.