net-imap v0.4.24 security fixes

{
  "id": "1c238ade2670d1390c38a11ea6e62d8dcd4b2cac099d5b284f04e04ae6c7e230",
  "url": "https://github.com/ruby/net-imap/releases/tag/v0.4.24",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "net-imap v0.4.24 security fixes",
    "summary": "net-imap v0.4.24 fixes vulnerabilities involving STARTTLS stripping, argument injection, and denial of service. The SCRAM iteration limit is configurable; its default does not protect against hostile servers unless users set a lower value.",
    "evidence": "This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.",
    "products": [
      {
        "name": {
          "value": "net-imap",
          "evidence": "Release notes from net-imap"
        },
        "prerequisites": [
          {
            "value": "generally only relevant when connecting to an untrusted hostile server (or without TLS)",
            "evidence": "These are generally only relevant when connecting to an untrusted hostile server (or without TLS)."
          },
          {
            "value": "it is explicitly set to a lower value by the user",
            "evidence": "It provides no protection against hostile servers unless it is explicitly set to a lower value by the user."
          }
        ],
        "fixed_versions": [
          {
            "value": "v0.4.24",
            "evidence": "v0.4.24"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-ruby-net-imap",
  "document_id": 22501,
  "published_at": "2026-07-02T22:03:57+00:00"
}