Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSummary
CVE-2025-25186 is a medium-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Denial of Service (T1498); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4076
Vulnerability Data
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0.5.6, there is a possibility for denial of service by memory exhaustion in `net-imap`'s response parser. At any…
more
time while the client is connected, a malicious server can send can send highly compressed `uid-set` data which is automatically read by the client's receiver thread. The response parser uses `Range#to_a` to convert the `uid-set` data into arrays of integers, with no limitation on the expanded size of the ranges. Versions 0.3.8, 0.4.19, 0.5.6, and higher fix this issue. Additional details for proper configuration of fixed versions and backward compatibility are available in the GitHub Security Advisory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 3 OS baselines
V1.1.1V1.4.2V2.1.1V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces a hard limit on concurrent sessions, structurally preventing unbounded resource allocation.
SC-5 directly limits the effects of resource-exhaustion events that constitute uncontrolled consumption.
SC-6 enforces explicit allocation limits on resources, structurally preventing the weakness from occurring.
Input validation can reject or limit decompression of data whose expansion ratio exceeds safe thresholds.
Imposes a limit on consecutive invalid attempts, preventing one specific class of unbounded resource consumption.
Least-functionality disables unnecessary services or features that could be leveraged for amplification.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.
Explicitly requires monitoring and maintaining resource capacity, directly addressing uncontrolled consumption to preserve availability.
Secure-development practices include input-validation and resource-limit checks that prevent improper handling of compressed data.
Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.
Continuous monitoring of computing resources can detect resource exhaustion but does not itself enforce allocation limits.
Hardened configuration baselines can include resource quotas and limits that constrain consumption.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Resource-utilization monitoring and alerting on bottlenecks or overloads limits the impact of denial-of-service or resource-exhaustion attacks.
Security testing can uncover decompression-bomb vulnerabilities before release.
By continuously monitoring utilization, stress-testing peak loads, and maintaining documented plans to scale or throttle resources, the control directly limits an attacker’s ability to drive a system into uncontrolled resource exhaustion.
Pre-agreed severity-based prioritization and resource allocation during incident triage reduce the likelihood that an attacker-induced resource exhaustion will overwhelm the organization before corrective action is taken.
Business-continuity plans that include resource-management controls reduce the likelihood that an attacker can trigger uncontrolled resource consumption by forcing the system into a degraded or fallback state.
Defining RTOs and capacity requirements for ICT services during business-impact analysis forces organizations to provision sufficient resources and throttling mechanisms, reducing the likelihood that an attacker can induce denial-of-service through uncontrolled resource consumption.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248552 OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-405, CWE-770
- V-248553 OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-405, CWE-770
Oracle Linux 9 (2 rules)
- V-271709 OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-405, CWE-770
- V-271710 OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-405, CWE-770
RHEL 8 (2 rules)
- V-230244 RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-405, CWE-770
- V-244525 RHEL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-405