The net-imap library in Ruby implements IMAP client functionality. Versions before 0.6.5 and 0.5.15 accept raw string arguments in several IMAP commands that are only validated against CRLF injection but otherwise sent verbatim. If these strings come from user-controlled input, an attacker can cause the next command to be treated as a continuation of the first, causing the first command to fail and block until another command is sent from a different thread. This blocking command will not return until the connection closes. This vulnerability is addressed in versions 0.6.5 and 0.5.15.

An attacker controlling input to vulnerable net-imap commands can cause command failures and induce blocking behavior in the IMAP client connection. This can disrupt normal IMAP command processing and potentially cause denial of service conditions in client applications using affected versions. The CVSS score of 2.1 indicates low severity with limited impact and attack complexity.

This vulnerability is fixed in net-imap versions 0.6.5 and 0.5.15. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated.