The Ruby net-imap library implements IMAP client functionality. In affected versions, when authenticating using SCRAM-SHA1 or SCRAM-SHA256, the client processes a server-supplied iteration count value. A malicious IMAP server can send an excessively large iteration count, causing the client to perform excessive computation, resulting in a computational denial-of-service (DoS) attack. This vulnerability is identified as CWE-1322 (Use of Blocking Code in Single-threaded, Non-blocking Context) and CWE-770 (Allocation of Resources Without Limits or Throttling). The issue has been addressed by patches in versions 0.4.24, 0.5.14, and 0.6.4.

A hostile IMAP server can exploit this vulnerability to cause a denial-of-service condition on the client by forcing it to perform expensive computations during authentication. This can degrade or halt client operations, impacting availability. There is no indication of privilege escalation, data disclosure, or code execution. No known exploits are reported in the wild.

Upgrade the Ruby net-imap library to version 0.4.24, 0.5.14, or 0.6.4 or later, where this vulnerability has been patched. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the version information in the advisory.