CVE-2025-24294

resolv: Denial of Service in resolv gem

Published Jul 12, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4716-1 ruby2.7 security update
EUVD EUVD EUVD-2025-21202 resolv vulnerable to DoS via insufficient DNS domain name length validation
Github GHSA Github GHSA GHSA-xh69-987w-hrp8 resolv vulnerable to DoS via insufficient DNS domain name length validation
Ubuntu USN Ubuntu USN USN-7734-1 Ruby vulnerabilities
Ubuntu USN Ubuntu USN USN-7735-1 RubyGems vulnerabilities
History
Type Values Removed Values Added
Title resolv: Denial of Service in resolv gem
References
Metrics threat_severity

None

threat_severity

Moderate

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Type Values Removed Values Added
Metrics epss

{'score': 0.00018}

epss

{'score': 0.00011}

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Metrics epss

{'score': 0.00018}

Type Values Removed Values Added
Description The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
References

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
hackerone
Published
Updated
Jul 16, 2025, 1:37 PM
Reserved
Jan 17, 2025, 1:00 AM
Status
Deferred
Published
Jul 12, 2025, 4:15 AM
Modified
Jun 17, 2026, 8:58 AM
Severity
Moderate
Public date
Jul 12, 2025, 3:30 AM