VDB
RHSA-2025%3A3906
RHSA-2025%3A3906
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in Ruby's net-imap library. In certain versions, there is a possibility for denial of service by memory exhaustion in the `net-imap` response parser. At any time while the client is connected, a malicious server can send highly compressed `uid-set` data, which is automatically read by the client's receiver thread. The response parser converts the `uid-set` data into arrays of integers with no limitation on the expanded size of the ranges, which can trigger memory exhaustion.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/cluster-logging-operator-bundle@sha256:dbabb3b3c43e5084731aebcd518fee508d6f7bdc2b0a5dc8d4bfe59ed10b033f_amd64 as a component of RHOL 5.9 for RHEL 9 | openshift-logging/cluster-logging-operator-bundle@sha256:dbabb3b3c43e5084731aebcd518fee508d6f7bdc2b0a5dc8d4bfe59ed10b033f_amd64, openshift-logging/cluster-logging-operator-bundle@sha256:dbabb3b3c43e5084731aebcd518fee508d6f7bdc2b0a5dc8d4bfe59ed10b033f_amd64, openshift-logging/cluster-logging-operator-bundle@sha256:dbabb3b3c43e5084731aebcd518fee508d6f7bdc2b0a5dc8d4bfe59ed10b033f_amd64 |
| Red Hat | openshift-logging/logging-loki-rhel9@sha256:69ca6d9abdddf7134dc13e7d56f7c0516fbbac16d817d39c9506258a01a12d94_s390x as a component of RHOL 5.9 for RHEL 9 | *, openshift-logging/logging-loki-rhel9@sha256:69ca6d9abdddf7134dc13e7d56f7c0516fbbac16d817d39c9506258a01a12d94_s390x, openshift-logging/logging-loki-rhel9@sha256:69ca6d9abdddf7134dc13e7d56f7c0516fbbac16d817d39c9506258a01a12d94_s390x |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:5e533297a7d58441eec5f8b7a35dcc465f2848a9eebe198217b9e3bb2fbd1061_arm64 as a component of RHOL 5.9 for RHEL 9 | *, openshift-logging/loki-rhel9-operator@sha256:5e533297a7d58441eec5f8b7a35dcc465f2848a9eebe198217b9e3bb2fbd1061_arm64, openshift-logging/loki-rhel9-operator@sha256:5e533297a7d58441eec5f8b7a35dcc465f2848a9eebe198217b9e3bb2fbd1061_arm64 |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:aee5721fb00afe90080988c5a3d3ae433584bdad4397af8231dda7c78a117732_s390x as a component of RHOL 5.9 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/cluster-logging-rhel9-operator@sha256:3539043c7d58d40d59bae337e6417ff629a455331c2a8f18072a61a0498c6b0f_ppc64le as a component of RHOL 5.9 for RHEL 9 | openshift-logging/cluster-logging-rhel9-operator@sha256:3539043c7d58d40d59bae337e6417ff629a455331c2a8f18072a61a0498c6b0f_ppc64le, *, openshift-logging/cluster-logging-rhel9-operator@sha256:3539043c7d58d40d59bae337e6417ff629a455331c2a8f18072a61a0498c6b0f_ppc64le |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel9@sha256:4e71c1ad1e4f4cf757d7db9aa0c1b278798ee1c8dc30885d2b8bd248a6ae5369_arm64 as a component of RHOL 5.9 for RHEL 9 | *, openshift-logging/log-file-metric-exporter-rhel9@sha256:4e71c1ad1e4f4cf757d7db9aa0c1b278798ee1c8dc30885d2b8bd248a6ae5369_arm64, openshift-logging/log-file-metric-exporter-rhel9@sha256:4e71c1ad1e4f4cf757d7db9aa0c1b278798ee1c8dc30885d2b8bd248a6ae5369_arm64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:6850fcc0f4f85a4572fd8f5da7c1f79ae765e86692d309e805c5b5ba4b67c4af_s390x as a component of RHOL 5.9 for RHEL 9 | *, openshift-logging/lokistack-gateway-rhel9@sha256:6850fcc0f4f85a4572fd8f5da7c1f79ae765e86692d309e805c5b5ba4b67c4af_s390x, openshift-logging/lokistack-gateway-rhel9@sha256:6850fcc0f4f85a4572fd8f5da7c1f79ae765e86692d309e805c5b5ba4b67c4af_s390x |
| Red Hat | openshift-logging/fluentd-rhel9@sha256:c76b12f9d59f2be7db69ecd3cb674a8c008852cd697f656c7cf6fba33fabe772_amd64 as a component of RHOL 5.9 for RHEL 9 | openshift-logging/fluentd-rhel9@sha256:c76b12f9d59f2be7db69ecd3cb674a8c008852cd697f656c7cf6fba33fabe772_amd64, openshift-logging/fluentd-rhel9@sha256:c76b12f9d59f2be7db69ecd3cb674a8c008852cd697f656c7cf6fba33fabe772_amd64, openshift-logging/fluentd-rhel9@sha256:c76b12f9d59f2be7db69ecd3cb674a8c008852cd697f656c7cf6fba33fabe772_amd64 |
| Red Hat | openshift-logging/opa-openshift-rhel9@sha256:9d21f986d9b0e58899e745f6e74f9463078117cc170c2e0adcf30cf6a862cae3_ppc64le as a component of RHOL 5.9 for RHEL 9 | openshift-logging/opa-openshift-rhel9@sha256:9d21f986d9b0e58899e745f6e74f9463078117cc170c2e0adcf30cf6a862cae3_ppc64le, *, openshift-logging/opa-openshift-rhel9@sha256:9d21f986d9b0e58899e745f6e74f9463078117cc170c2e0adcf30cf6a862cae3_ppc64le |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:0a8711edfd92e8e22ed060964b6ddb9a5bd8ba2cee037c760d2a0c7f8c8939ff_arm64 as a component of RHOL 5.9 for RHEL 9 | openshift-logging/lokistack-gateway-rhel9@sha256:0a8711edfd92e8e22ed060964b6ddb9a5bd8ba2cee037c760d2a0c7f8c8939ff_arm64, openshift-logging/lokistack-gateway-rhel9@sha256:0a8711edfd92e8e22ed060964b6ddb9a5bd8ba2cee037c760d2a0c7f8c8939ff_arm64, openshift-logging/lokistack-gateway-rhel9@sha256:0a8711edfd92e8e22ed060964b6ddb9a5bd8ba2cee037c760d2a0c7f8c8939ff_arm64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:b4133caf795ead8349ae7f4d6aff99c6a17e213217d2f51a7186e3fbcf7cef27_amd64 as a component of RHOL 5.9 for RHEL 9 | openshift-logging/lokistack-gateway-rhel9@sha256:b4133caf795ead8349ae7f4d6aff99c6a17e213217d2f51a7186e3fbcf7cef27_amd64, openshift-logging/lokistack-gateway-rhel9@sha256:b4133caf795ead8349ae7f4d6aff99c6a17e213217d2f51a7186e3fbcf7cef27_amd64, openshift-logging/lokistack-gateway-rhel9@sha256:b4133caf795ead8349ae7f4d6aff99c6a17e213217d2f51a7186e3fbcf7cef27_amd64 |
| Red Hat | openshift-logging/eventrouter-rhel9@sha256:a6410818a8dcfed63a24ed9cecf3d0fe309983278e2cc56caf914732021c35cb_arm64 as a component of RHOL 5.9 for RHEL 9 | openshift-logging/eventrouter-rhel9@sha256:a6410818a8dcfed63a24ed9cecf3d0fe309983278e2cc56caf914732021c35cb_arm64, openshift-logging/eventrouter-rhel9@sha256:a6410818a8dcfed63a24ed9cecf3d0fe309983278e2cc56caf914732021c35cb_arm64, openshift-logging/eventrouter-rhel9@sha256:a6410818a8dcfed63a24ed9cecf3d0fe309983278e2cc56caf914732021c35cb_arm64 |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel9@sha256:47f7cbd4c70880374b4583e8bee11b48b46402a8df49b76065cde23f32a2dd8b_amd64 as a component of RHOL 5.9 for RHEL 9 | openshift-logging/log-file-metric-exporter-rhel9@sha256:47f7cbd4c70880374b4583e8bee11b48b46402a8df49b76065cde23f32a2dd8b_amd64, openshift-logging/log-file-metric-exporter-rhel9@sha256:47f7cbd4c70880374b4583e8bee11b48b46402a8df49b76065cde23f32a2dd8b_amd64, openshift-logging/log-file-metric-exporter-rhel9@sha256:47f7cbd4c70880374b4583e8bee11b48b46402a8df49b76065cde23f32a2dd8b_amd64 |
| Red Hat | openshift-logging/fluentd-rhel9@sha256:8d4861653f699249106269bf6c22d85dfa6b21e46f950c39267d076f32335037_ppc64le as a component of RHOL 5.9 for RHEL 9 | openshift-logging/fluentd-rhel9@sha256:8d4861653f699249106269bf6c22d85dfa6b21e46f950c39267d076f32335037_ppc64le, openshift-logging/fluentd-rhel9@sha256:8d4861653f699249106269bf6c22d85dfa6b21e46f950c39267d076f32335037_ppc64le, openshift-logging/fluentd-rhel9@sha256:8d4861653f699249106269bf6c22d85dfa6b21e46f950c39267d076f32335037_ppc64le |
| Red Hat | openshift-logging/cluster-logging-rhel9-operator@sha256:8a735ea6035e59ec0be9c08f9b7dc50146f8a15d6b8a440e550d799fc2ab2bfb_arm64 as a component of RHOL 5.9 for RHEL 9 | *, *, openshift-logging/cluster-logging-rhel9-operator@sha256:8a735ea6035e59ec0be9c08f9b7dc50146f8a15d6b8a440e550d799fc2ab2bfb_arm64 |
| Red Hat | openshift-logging/logging-view-plugin-rhel9@sha256:8f9ef4f885a9feb96b9be4e7b2ec32f100b5c135267a5c9cb28e941deccded3a_arm64 as a component of RHOL 5.9 for RHEL 9 | *, openshift-logging/logging-view-plugin-rhel9@sha256:8f9ef4f885a9feb96b9be4e7b2ec32f100b5c135267a5c9cb28e941deccded3a_arm64, * |
| Red Hat | openshift-logging/fluentd-rhel9@sha256:aa88fc2cb75d9f006f9d2e5aad15d2b1b8eaa0e80935c4c277d10ea5a2e93963_s390x as a component of RHOL 5.9 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:aee5721fb00afe90080988c5a3d3ae433584bdad4397af8231dda7c78a117732_s390x as a component of RHOL 5.9 for RHEL 9 | *, *, openshift-logging/loki-rhel9-operator@sha256:aee5721fb00afe90080988c5a3d3ae433584bdad4397af8231dda7c78a117732_s390x |
| Red Hat | openshift-logging/logging-view-plugin-rhel9@sha256:9a0af2cd5f384ce9c567342cfd65a2918d3fe9f7ef7c84d7a400d1fec93a2d2e_ppc64le as a component of RHOL 5.9 for RHEL 9 | openshift-logging/logging-view-plugin-rhel9@sha256:9a0af2cd5f384ce9c567342cfd65a2918d3fe9f7ef7c84d7a400d1fec93a2d2e_ppc64le, *, * |
| Red Hat | openshift-logging/eventrouter-rhel9@sha256:80cc7ad26b3636524fb74173f0515dd59c22a96f3df19542dde1b83e855d8aff_ppc64le as a component of RHOL 5.9 for RHEL 9 | openshift-logging/eventrouter-rhel9@sha256:80cc7ad26b3636524fb74173f0515dd59c22a96f3df19542dde1b83e855d8aff_ppc64le, *, * |
…and 64 more
Timeline
- Apr 16, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:3906 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2344680 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2347423 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2351231 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://issues.redhat.com/browse/LOG-6855 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3906.json advisory
- https://access.redhat.com/security/cve/CVE-2025-25186 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-25186 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-25186 advisory
- https://github.com/ruby/net-imap/commit/70e3ddd071a94e450b3238570af482c296380b35 advisory
- https://github.com/ruby/net-imap/commit/c8c5a643739d2669f0c9a6bb9770d0c045fd74a3 advisory
- https://github.com/ruby/net-imap/commit/cb92191b1ddce2d978d01b56a0883b6ecf0b1022 advisory
- https://github.com/ruby/net-imap/security/advisories/GHSA-7fc5-f82f-cx69 advisory
- https://access.redhat.com/security/cve/CVE-2025-27144 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-27144 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-27144 advisory
- https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22 advisory
- https://github.com/go-jose/go-jose/releases/tag/v4.0.5 advisory
…and 12 more