CVE-2025-43857

Medium

Advisory

Published 28 Apr 2025In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 20; of 17,781 indexed, latest versions
Container images: 22; deployed by those charts
Fix available: 1 of 5; affected packages

net-imap rubygem vulnerable to possible DoS by memory exhaustion

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 22 images.

Affected package	Affected versions	Fixed in	Images
ruby2.7deb	2.7.0-5ubuntu1.4, 2.7.0-5ubuntu1.5, 2.7.0-5ubuntu1.8	no fix listed	6
ruby3.0deb	3.0.2-7ubuntu2.4, 3.0.2-7ubuntu2.8	no fix listed	2
ruby2.5deb	2.5.8-1bbox1~bionic1	no fix listed	1
ruby3.1deb	3.1.2-7+deb12u1	no fix listed	1
net-imapgem	0.1.1, 0.2.3, 0.2.4, 0.3.4+4 more	0.2.5, 0.3.9, 0.4.20, 0.5.7	15

OSV records: DEBIAN-CVE-2025-43857 GHSA-j3g3-5qv5-52mj UBUNTU-CVE-2025-43857

Charts affected

20 by stars

Chart

Latest

Affected images

Radar Score

puppetserverpuppetserver

9.5.2

1 of 5 See more

puppetserver puppetserver 9.5.2

1 of the 5 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	ruby3.0@3.0.2-7ubuntu2.4 net-imap@0.1.1	no fix listed 0.2.5

Open the chart page →

14,184

huginnutkuozdemir

2.2.1

1 of 4 See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
huginn/huginn-single-process :4d17829cf6b15b004ad3f4be196303dca4944810	c794eddc7b47	ruby2.5@2.5.8-1bbox1~bionic1	no fix listed

Open the chart page →

18,137

mastodondefault-gh

0.3.1

1 of 3 See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	net-imap@0.3.4	0.3.9

Open the chart page →

5,056

opennebulakvaps

2.1.1

5 of 9 See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/kvaps/opennebula :v5.12.0.4-1	e28e0e7de11b	ruby2.7@2.7.0-5ubuntu1.5	no fix listed
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4	01563adc95fd	ruby2.7@2.7.0-5ubuntu1.4	no fix listed
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4-1	2b92df1143b9	ruby2.7@2.7.0-5ubuntu1.5	no fix listed
ghcr.io/kvaps/opennebula-flow :v5.12.0.4-1	600221f0f43f	ruby2.7@2.7.0-5ubuntu1.5	no fix listed
ghcr.io/kvaps/opennebula-gate :v5.12.0.4-1	a85e03d8bc1d	ruby2.7@2.7.0-5ubuntu1.5	no fix listed

Open the chart page →

113,791

chatwootmaxcrm-charts

1.1.201

1 of 4 See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
chatwoot/chatwoot :v3.1.0	d530ab8c1753	net-imap@0.3.7	0.3.9

Open the chart page →

5,940

ansible-inspecansible-inspec

0.2.17

1 of 2 See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	net-imap@0.2.4	0.2.5

Open the chart page →

5,558

puppetservercamptocamp3

1.0.1

1 of 2 See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	ruby3.0@3.0.2-7ubuntu2.8 net-imap@0.1.1	no fix listed 0.2.5

Open the chart page →

5,886

caninecanine

0.1.10

1 of 7 See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/caninehq/canine :latest	a058034ca006	net-imap@0.4.9.1	0.4.20

Open the chart page →

14,130

icinga2geek-cookbook

4.2.0

1 of 1 See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
jordan/icinga2 :latest	f75025fe8ea8	ruby3.1@3.1.2-7+deb12u1 net-imap@0.2.3	no fix listed 0.2.5

Open the chart page →

9,077

opentelemetry-demogpg-dev

0.33.8

1 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :1.12.0-emailservice	a1f5cebb5240	net-imap@0.3.6	0.3.9

Open the chart page →

49,025

docker-registry-browsergtaylor

0.4.4

1 of 1 See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
klausmeyer/docker-registry-browser :1.4.0	bdc4c6b8595b	net-imap@0.1.1	0.2.5

Open the chart page →

3,564

fluentd-elasticsearchkfirfer

13.9.1

1 of 1 See more

fluentd-elasticsearch kfirfer 13.9.1

1 of the 1 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
quay.io/fluentd_elasticsearch/fluentd :v4.2.3	99079df58561	net-imap@0.2.3	0.2.5

Open the chart page →

1,178

lm-logslogicmonitor

0.3.5

1 of 1 See more

lm-logs logicmonitor 0.3.5

1 of the 1 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
logicmonitor/lm-logs-k8s-fluentd :1.0.5	5ac21b3f1572	net-imap@0.2.3	0.2.5

Open the chart page →

1,029

maxcrm-chartsmaxcrm-charts

1.1.201

1 of 4 See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
chatwoot/chatwoot :v3.1.0	d530ab8c1753	net-imap@0.3.7	0.3.9

Open the chart page →

5,940

danboorumy0n

0.0.2

1 of 1 See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	net-imap@0.2.3	0.2.5

Open the chart page →

12,791

danbooru-stackmy0n

0.0.3

1 of 4 See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	net-imap@0.2.3	0.2.5

Open the chart page →

12,791

mastodonrivals-space

3.1.2

1 of 3 See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/rivals-space/rivals-mastodon :1.6.1	43b23d55e4be	net-imap@0.1.1	0.2.5

Open the chart page →

6,026

fluentd-operatorstatcan

0.5.1

1 of 1 See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
vmware/kube-fluentd-operator :latest	f028c138a5f4	net-imap@0.3.7	0.3.9

Open the chart page →

1,955

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	net-imap@0.5.4	0.5.7

Open the chart page →

10,795

kongwallarm

4.6.3

1 of 7 See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2025-43857.

Container image	Digest	Package	Fixed in
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	ruby2.7@2.7.0-5ubuntu1.8	no fix listed

Open the chart page →

11,405

Container images carrying it

22 by charts deploying them

A fixed version is listed for 1 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
chatwoot/chatwoot :v3.1.0	d530ab8c1753	net-imap@0.3.7	0.3.9	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	net-imap@0.2.3	0.2.5	2
huginn/huginn-single-process :4d17829cf6b15b004ad3f4be196303dca4944810	c794eddc7b47	ruby2.5@2.5.8-1bbox1~bionic1	no fix listed	1
jordan/icinga2 :latest	f75025fe8ea8	ruby3.1@3.1.2-7+deb12u1 net-imap@0.2.3	no fix listed 0.2.5	1
klausmeyer/docker-registry-browser :1.4.0	bdc4c6b8595b	net-imap@0.1.1	0.2.5	1
logicmonitor/lm-logs-k8s-fluentd :1.0.5	5ac21b3f1572	net-imap@0.2.3	0.2.5	1
vmware/kube-fluentd-operator :latest	f028c138a5f4	net-imap@0.3.7	0.3.9	1
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	ruby2.7@2.7.0-5ubuntu1.8	no fix listed	1
ghcr.io/caninehq/canine :latest	a058034ca006	net-imap@0.4.9.1	0.4.20	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	net-imap@0.2.4	0.2.5	1
ghcr.io/kvaps/opennebula :v5.12.0.4-1	e28e0e7de11b	ruby2.7@2.7.0-5ubuntu1.5	no fix listed	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4	01563adc95fd	ruby2.7@2.7.0-5ubuntu1.4	no fix listed	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4-1	2b92df1143b9	ruby2.7@2.7.0-5ubuntu1.5	no fix listed	1
ghcr.io/kvaps/opennebula-flow :v5.12.0.4-1	600221f0f43f	ruby2.7@2.7.0-5ubuntu1.5	no fix listed	1
ghcr.io/kvaps/opennebula-gate :v5.12.0.4-1	a85e03d8bc1d	ruby2.7@2.7.0-5ubuntu1.5	no fix listed	1
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	net-imap@0.3.4	0.3.9	1
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	net-imap@0.5.4	0.5.7	1
ghcr.io/open-telemetry/demo :1.12.0-emailservice	a1f5cebb5240	net-imap@0.3.6	0.3.9	1
ghcr.io/rivals-space/rivals-mastodon :1.6.1	43b23d55e4be	net-imap@0.1.1	0.2.5	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	ruby3.0@3.0.2-7ubuntu2.4 net-imap@0.1.1	no fix listed 0.2.5	1
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	ruby3.0@3.0.2-7ubuntu2.8 net-imap@0.1.1	no fix listed 0.2.5	1
quay.io/fluentd_elasticsearch/fluentd :v4.2.3	99079df58561	net-imap@0.2.3	0.2.5	1