# CVE-2025-43857: ruby3.2-bundled-gems-debuginfo: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-43857: Net::IMA... CVE-2025-43857 is fixed in 32 products on 1 platform, first by ALAS2023-2025-1168, released August 26, 2025. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2025-43857 - Priority: Routine - CVSS: n/a (moderate) - EPSS: 0.0049 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 26, 2025 ## Description Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-43857: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. At any time while the client is connected, a malicious server can send can send a "literal" byte count, which is automatically read by the client's receiver thread. The response reader immediately allocates memory for the number of bytes indicated by the server response. This should not be an issue when securely connecting to trusted IMAP servers that are well-behaved. It can affect insecure connections and buggy, untrusted, or compromised servers (for example, connecting to a user supplied hostname). This issue has been patched in versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | ruby3.2 amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-bundled-gems amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-bundled-gems-debuginfo amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-debuginfo amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-debugsource amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-default-gems amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-devel amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-doc amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-libs amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-libs-debuginfo amzn 2023 | 3.2.8-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-bigdecimal amzn 2023 | 3.1.3-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-bigdecimal-debuginfo amzn 2023 | 3.1.3-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-bundler amzn 2023 | 2.4.19-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-io-console amzn 2023 | 0.6.0-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-io-console-debuginfo amzn 2023 | 0.6.0-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-irb amzn 2023 | 1.6.2-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-json amzn 2023 | 2.6.3-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-json-debuginfo amzn 2023 | 2.6.3-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-minitest amzn 2023 | 5.25.1-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-power_assert amzn 2023 | 2.0.3-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-psych amzn 2023 | 5.0.1-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-psych-debuginfo amzn 2023 | 5.0.1-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-rake amzn 2023 | 13.0.6-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-rbs amzn 2023 | 2.8.2-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-rbs-debuginfo amzn 2023 | 2.8.2-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-rdoc amzn 2023 | 6.5.1.1-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-rexml amzn 2023 | 3.3.9-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-rss amzn 2023 | 0.3.1-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-test-unit amzn 2023 | 3.5.7-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygem-typeprof amzn 2023 | 0.21.3-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygems amzn 2023 | 3.4.19-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | | Linux | ruby3.2-rubygems-devel amzn 2023 | 3.4.19-184.amzn2023.0.5 | [ALAS2023-2025-1168](https://patchblox.com/security/data/fix/linux/alas2023-2025-1168.md) | Aug 26, 2025 | --- Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.