Sourced from net-imap's releases.
v0.4.19
What's Changed
🔒 Security Fix
Fixes CVE-2025-25186 (GHSA-7fc5-f82f-cx69): A malicious server can exhaust client memory by sending
APPENDUIDorCOPYUIDresponses with very largeuid-setranges.Net::IMAP::UIDPlusDataexpands these ranges into arrays of integers.Fix with minor API changes
Set
config.parser_use_deprecated_uidplus_datatofalseto replaceUIDPlusDatawithAppendUIDDataandCopyUIDData. These classes store their UIDs asNet::IMAP::SequenceSetobjects (not expanded into arrays of integers). Code that does not handleAPPENDUIDorCOPYUIDresponses should not see any difference. Code that does handle these responses may need to be updated.For v0.3.8, this option is not available For v0.4.19, the default value is
true. For v0.5.6, the default value is:up_to_max_size. For v0.6.0, the only allowed value will befalse(UIDPlusDatawill be removed from v0.6).Mitigate with backward compatible API
Adjust
config.parser_max_deprecated_uidplus_data_sizeto limit the maximumUIDPlusDataUID set size. Whenconfig.parser_use_deprecated_uidplus_data == true, larger sets will crash. Whenconfig.parser_use_deprecated_uidplus_data == :up_to_max_size, larger sets will useAppendUIDDataorCopyUIDData.For v0.3,8, this limit is hard-coded to 10,000. For v0.4.19, this limit defaults to 1000. For v0.5.6, this limit defaults to 100. For v0.6.0, the only allowed value will be
0(UIDPlusDatawill be removed from v0.6).Please Note: unhandled responses
If the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However,
net-imaphas always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. This is not significantly different from connecting to a trusted server with a long-lived connection. To limit the maximum number of retained responses, a simple handler might look something like the following:limit = 1000 imap.add_response_handler do |resp| next unless resp.respond_to?(:name) && resp.respond_to?(:data) name = resp.name code = resp.data.code&.name if resp.data.in?(Net::IMAP::ResponseText) imap.responses(name) { _1.slice!(0...-limit) } imap.responses(code) { _1.slice!(0...-limit) } endAdded
- 🔧 ResponseParser config is mutable and non-global (backports #381) by
@nevansin ruby/net-imap#382- ✨ SequenceSet ordered entries methods (backports to v0.4-stable) by
@nevansin ruby/net-imap#402 Backports the following:
- ✨ Add SequenceSet methods for querying about duplicates by
@nevansin ruby/net-imap#384- ✨ Add
SequenceSet#each_ordered_numberby@nevansin ruby/net-imap#386- ✨ Add
SequenceSet#find_ordered_indexby@nevansin ruby/net-imap#396- ✨ Add
SequenceSet#ordered_atby@nevansin ruby/net-imap#397- ✨ Backport UIDPlusData, AppendUIDData, CopyUIDData to v0.4 by
@nevansin ruby/net-imap#404 Backports the following:
- ✨ Add AppendUIDData and CopyUIDData classes by
@nevansin ruby/net-imap#400
... (truncated)
4c4ed09
🔖 Bump version to 0.4.19c8c5a64
Merge commit from forkabff00f
🔧 Add :up_to_max_size config for UIDPlusData34a1f27
🔧 Add config option for max UIDPlusData size6613d57
🔒 Limit exponential memory usage to parse uid-sete4d57b1
🔀 Merge pull request #404
from ruby/backport-0.4-uidplus-deprecationd32320a
🐛 Fix missing Data.define for new classes3c592fc
🔧🗑️ Deprecate UIDPlusData, with config to upgrade7e58ef3
✨ Add CopyUIDData (to replace UIDPlusData)4c601c3
✨ Add AppendUIDData (to replace UIDPlusData)