CVE-2025-24294

EUVD-2025-21202

12.07.2025, 04:15

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 44.72%

Debian Releases

Debian Product

Codename

ruby2.7

bullseye	vulnerable
bullseye (security)	2.7.4-1+deb11u6 fixed

ruby3.1

bookworm	no-dsa
bookworm (security)	vulnerable

ruby3.3

forky	vulnerable
sid	vulnerable
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

jruby

bionic	needs-triage
focal	needs-triage
jammy	dne
noble	needs-triage
plucky	ignored
questing	ignored
resolute	needs-triage
trusty	needs-triage
xenial	needs-triage

ruby2.3

jammy	dne
noble	dne
plucky	dne
questing	dne
resolute	dne
xenial	needs-triage

ruby2.5

bionic	Fixed 2.5.1-1ubuntu1.16+esm5 released
jammy	dne
noble	dne
plucky	dne
questing	dne
resolute	dne

ruby2.7

focal	Fixed 2.7.0-5ubuntu1.18+esm1 released
jammy	dne
noble	dne
plucky	dne
questing	dne
resolute	dne

ruby3.0

jammy	Fixed 3.0.2-7ubuntu2.11 released
noble	dne
plucky	dne
questing	dne
resolute	dne

ruby3.2

jammy	dne
noble	Fixed 3.2.3-1ubuntu0.24.04.6 released
plucky	dne
questing	dne
resolute	dne

ruby3.3

jammy	dne
noble	dne
plucky	Fixed 3.3.7-1ubuntu2.1 released
questing	Fixed 3.3.8-2ubuntu2 released
resolute	Fixed 3.3.8-2ubuntu2 released

rubygems

jammy	not-affected
noble	not-affected
plucky	Fixed 3.6.3-1ubuntu0.1 released
questing	Fixed 3.6.7-2ubuntu1 released
resolute	Fixed 3.6.7-2ubuntu1 released

openSUSE / SLES Releases

openSUSE Product

Release

libruby2_5-2_5

suse enterprise desktop 15 SP6	2.5.9-150000.4.54.1 fixed
suse enterprise desktop 15 SP7	2.5.9-150700.24.3.1 fixed
suse enterprise sap 15 SP6	2.5.9-150000.4.54.1 fixed
suse enterprise sap 15 SP7	2.5.9-150700.24.3.1 fixed
suse enterprise server 15 SP4	2.5.9-150000.4.54.1 fixed
suse enterprise server 15 SP6	2.5.9-150000.4.54.1 fixed
suse enterprise server 15 SP7	2.5.9-150700.24.3.1 fixed

Amazon Linux Releases

Amazon Package

Release

ruby

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.16

fixed

ruby-debuginfo

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.16

fixed

ruby-devel

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.16

fixed

ruby-doc

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.16

fixed

ruby-irb

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.16

fixed

ruby-libs

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.16

fixed

ruby-tcltk

Amazon Linux 2

0:2.0.0.648-36.amzn2.0.16

fixed

ruby3.2

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-bundled-gems

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-bundled-gems-debuginfo

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-debuginfo

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-debugsource

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-default-gems

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-devel

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-doc

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-libs

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-libs-debuginfo

Amazon Linux 2023

0:3.2.8-184.amzn2023.0.3

fixed

ruby3.2-rubygem-bigdecimal

Amazon Linux 2023

0:3.1.3-184.amzn2023.0.3

fixed

ruby3.2-rubygem-bigdecimal-debuginfo

Amazon Linux 2023

0:3.1.3-184.amzn2023.0.3

fixed

ruby3.2-rubygem-bundler

Amazon Linux 2023

0:2.4.19-184.amzn2023.0.3

fixed

ruby3.2-rubygem-io-console

Amazon Linux 2023

0:0.6.0-184.amzn2023.0.3

fixed

ruby3.2-rubygem-io-console-debuginfo

Amazon Linux 2023

0:0.6.0-184.amzn2023.0.3

fixed

ruby3.2-rubygem-irb

Amazon Linux 2023

0:1.6.2-184.amzn2023.0.3

fixed

ruby3.2-rubygem-json

Amazon Linux 2023

0:2.6.3-184.amzn2023.0.3

fixed

ruby3.2-rubygem-json-debuginfo

Amazon Linux 2023

0:2.6.3-184.amzn2023.0.3

fixed

ruby3.2-rubygem-minitest

Amazon Linux 2023

0:5.25.1-184.amzn2023.0.3

fixed

ruby3.2-rubygem-power_assert

Amazon Linux 2023

0:2.0.3-184.amzn2023.0.3

fixed

ruby3.2-rubygem-psych

Amazon Linux 2023

0:5.0.1-184.amzn2023.0.3

fixed

ruby3.2-rubygem-psych-debuginfo

Amazon Linux 2023

0:5.0.1-184.amzn2023.0.3

fixed

ruby3.2-rubygem-rake

Amazon Linux 2023

0:13.0.6-184.amzn2023.0.3

fixed

ruby3.2-rubygem-rbs

Amazon Linux 2023

0:2.8.2-184.amzn2023.0.3

fixed

ruby3.2-rubygem-rbs-debuginfo

Amazon Linux 2023

0:2.8.2-184.amzn2023.0.3

fixed

ruby3.2-rubygem-rdoc

Amazon Linux 2023

0:6.5.1.1-184.amzn2023.0.3

fixed

ruby3.2-rubygem-rexml

Amazon Linux 2023

0:3.3.9-184.amzn2023.0.3

fixed

ruby3.2-rubygem-rss

Amazon Linux 2023

0:0.3.1-184.amzn2023.0.3

fixed

ruby3.2-rubygem-test-unit

Amazon Linux 2023

0:3.5.7-184.amzn2023.0.3

fixed

ruby3.2-rubygem-typeprof

Amazon Linux 2023

0:0.21.3-184.amzn2023.0.3

fixed

ruby3.2-rubygems

Amazon Linux 2023

0:3.4.19-184.amzn2023.0.3

fixed

ruby3.2-rubygems-devel

Amazon Linux 2023

0:3.4.19-184.amzn2023.0.3

fixed

rubygem-bigdecimal

Amazon Linux 2

0:1.2.0-36.amzn2.0.16

fixed

rubygem-io-console

Amazon Linux 2

0:0.4.2-36.amzn2.0.16

fixed

rubygem-json

Amazon Linux 2

0:1.7.7-36.amzn2.0.16

fixed

rubygem-minitest

Amazon Linux 2

0:4.3.2-36.amzn2.0.16

fixed

rubygem-psych

Amazon Linux 2

0:2.0.0-36.amzn2.0.16

fixed

rubygem-rake

Amazon Linux 2

0:0.9.6-36.amzn2.0.16

fixed

rubygem-rdoc

Amazon Linux 2

0:4.0.0-36.amzn2.0.16

fixed

rubygems

Amazon Linux 2

0:2.0.14.1-36.amzn2.0.16

fixed

rubygems-devel

Amazon Linux 2

0:2.0.14.1-36.amzn2.0.16

fixed

Azure Linux Releases

Azure Package

Release

ruby

Azure Linux 3.0	0:3.3.5-5.azl3 fixed
CBL-Mariner 2.0	0:3.1.7-3.cm2 fixed

Common Weakness Enumeration

CWE-400 - Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/