resolv: Denial of Service in resolv gem
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ruby | resolv | unaffected |
|
No data.
No data.
No data available yet.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4716-1 | ruby2.7 security update |
EUVD |
EUVD-2025-21202 | resolv vulnerable to DoS via insufficient DNS domain name length validation |
Github GHSA |
GHSA-xh69-987w-hrp8 | resolv vulnerable to DoS via insufficient DNS domain name length validation |
Ubuntu USN |
USN-7734-1 | Ruby vulnerabilities |
Ubuntu USN |
USN-7735-1 | RubyGems vulnerabilities |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.656% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Title | resolv: Denial of Service in resolv gem | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-400 | |
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition. | |
| References |
|
No data.