# Possible DoS by memory exhaustion in net/imap

net-imap's response parser expands compressed uid-set ranges via Range#to_a without size limits, letting a malicious IMAP server exhaust client memory and cause DoS.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: manun
- Disclosed: 2025-04-27
- CVE: CVE-2025-25186
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2987782
- Library page: https://bugbountylibrary.com/r/h1%3A2987782
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:dos

**Target:** Ruby net-imap gem response parser (IMAP client)
**Root cause:** The response parser converts attacker-supplied uid-set data into integer arrays using Range#to_a with no cap on the expanded size of ranges, so a compact range like `1:999999999` expands to a huge array.
**Steps:**
1. Connect a net-imap client (0.3.2 <= version < 0.3.8/0.4.19/0.5.6) to a malicious IMAP server.
2. Server sends a response containing a highly compressed uid-set, e.g. a huge range such as `1:999999999`.
3. Client receiver thread automatically parses it and calls Range#to_a, allocating a massive integer array.
4. Repeat/large enough range exhausts client memory, causing DoS.
**Exploitation:** A malicious or compromised IMAP server sends crafted uid-set ranges in responses; the client's receiver thread auto-parses them, expanding ranges into unbounded arrays and exhausting memory without user interaction.
**Insight:** When auditing protocol clients, look for server-controlled set/range syntax (uid-sets, sequence sets, ranges) that gets materialized into arrays—Range#to_a on attacker input is an unbounded allocation primitive.