Skip to content
Fencer Vulns
high 7.5

CVE-2025-24294 json

resolv vulnerable to DoS via insufficient DNS domain name length validation

published 2025-07-12 15 mo ago modified 2026-09-10 1 mo ago also GHSA-xh69-987w-hrp8 , EUVD-2025-21202

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Patch / fix

  • rubygems resolv 0.2.3, 0.3.1, 0.6.2
  • ruby3.3 Debian 13 3.3.13-0+deb13u1

debian advisories DEBIAN-CVE-2025-24294

  • ruby3.0 Ubuntu 22.04 LTS 3.0.2-7ubuntu2.11
  • ruby3.2 Ubuntu 24.04 LTS 3.2.3-1ubuntu0.24.04.6
  • ruby3.3 Ubuntu 26.04 LTS, Ubuntu 25.10 3.3.8-2ubuntu2
  • rubygems Ubuntu 26.04 LTS, Ubuntu 25.10 3.6.7-2ubuntu1
  • ruby2.5 Ubuntu Pro 18.04 LTS 2.5.1-1ubuntu1.16+esm5
  • ruby2.7 Ubuntu Pro 20.04 LTS 2.7.0-5ubuntu1.18+esm1

ubuntu advisories UBUNTU-CVE-2025-24294

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ruby RHEL 10.1 3.3.10-11.el10_1
  • rubygems RHEL 10.1 3.5.22-11.el10_1
  • ruby-libs RHEL 10.1 3.3.10-11.el10_1
  • rubygem-irb RHEL 10.1 1.13.1-11.el10_1
  • rubygem-rbs RHEL 10.1 3.4.0-11.el10_1
  • rubygem-rss RHEL 10.1 0.3.1-11.el10_1
  • rubygem-json RHEL 10.1 2.7.2-11.el10_1
  • rubygem-racc RHEL 10.1 1.7.3-11.el10_1

red hat advisories RHSA-2025:23141RHSA-2025:23062RHSA-2025:23063RHSA-2025:23927RHSA-2025:23648

  • ruby2.5 SLE Module for Basesystem 15 SP7 2.5.9-150700.24.3.1
  • ruby2.5 SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 2.5.9-150000.4.54.1

suse advisories SUSE-SU-2025:4264-1SUSE-SU-2025:3776-1

  • rubygems AlmaLinux 10 3.5.22-11.el10_1
  • rubygem-irb AlmaLinux 10 1.13.1-11.el10_1
  • rubygem-rss AlmaLinux 10 0.3.1-11.el10_1
  • rubygem-rake AlmaLinux 10 13.1.0-11.el10_1
  • rubygem-rdoc AlmaLinux 10 6.6.3.1-11.el10_1
  • rubygem-rexml AlmaLinux 10 3.4.4-11.el10_1
  • rubygem-bundler AlmaLinux 10 2.5.22-11.el10_1
  • rubygem-minitest AlmaLinux 10 5.20.0-11.el10_1

almalinux advisories ALSA-2025:23141ALSA-2025:23062ALSA-2025:23063

  • ruby Rocky Linux 10 3.3.10-11.el10_1
  • ruby Rocky Linux 9 3.3.10-5.module+el9.7.0+40039+300ba1ed
  • rubygem-pg Rocky Linux 9 1.5.4-1.module+el9.7.0+40032+36e56d0d.0.1
  • rubygem-mysql2 Rocky Linux 9 0.5.5-3.module+el9.7.0+40032+36e56d0d
  • ruby Rocky Linux 8 3.3.10-5.module+el8.10.0+40038+e29e4152
  • rubygem-pg Rocky Linux 8 1.5.4-1.module+el8.10.0+1679+61871737
  • rubygem-pg Rocky Linux 8 1.5.4-1.module+el8.10.0+1827+16ecb9d2
  • rubygem-abrt Rocky Linux 8 0.4.0-1.module+el8.10.0+1827+16ecb9d2

rocky linux advisories RLSA-2025:23141RLSA-2025:23063RLSA-2025:23062

  • ruby CBL-Mariner 2.0 3.1.7-3
  • ruby Azure Linux 3.0 3.3.5-5

azure linux advisories AZL-65202AZL-65241

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-24294 updated cvss 5.3

resolv: Denial of Service in resolv gem

  • Red Hat Enterprise Linux 6 ruby, ruby-ri, ruby-irb, ruby-libs, ruby-rdoc, ruby-tcltk Red Hat Enterprise Linux 7 ruby, ruby-irb, rubygems, ruby-libs, ruby-tcltk, rubygem-json, +6 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 ruby, ruby-irb, rubygems, ruby-libs, rubygem-pg, rubygem-irb, +25 more Red Hat Enterprise Linux 9 ruby, rubygems, ruby-libs, rubygem-irb, rubygem-rbs, rubygem-rss, +13 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AppStream (v. 8) ruby 3.3.10-5.module+el8.10.0+23696+c42b0f57, rubygems 3.5.22-5.module+el8.10.0+23696+c42b0f57, ruby-libs 3.3.10-5.module+el8.10.0+23696+c42b0f57, rubygem-pg 1.5.4-1.module+el8.10.0+21226+b78a28c4, rubygem-rbs 3.4.0-5.module+el8.10.0+23696+c42b0f57, rubygem-rss 0.3.1-5.module+el8.10.0+23696+c42b0f57, +18 more
    fixed: vendor fix RHSA-2025:23062
  • Red Hat Enterprise Linux AppStream (v. 9) ruby 3.3.10-5.module+el9.7.0+23651+15dc1615, rubygems 3.5.22-5.module+el9.7.0+23651+15dc1615, ruby-libs 3.3.10-5.module+el9.7.0+23651+15dc1615, rubygem-pg 1.5.4-1.module+el9.4.0+21222+faeeed2f, rubygem-rbs 3.4.0-5.module+el9.7.0+23651+15dc1615, rubygem-rss 0.3.1-5.module+el9.7.0+23651+15dc1615, +17 more
    fixed: vendor fix RHSA-2025:23063
  • Red Hat Enterprise Linux AppStream (v. 10) ruby 3.3.10-11.el10_1, rubygems 3.5.22-11.el10_1, ruby-libs 3.3.10-11.el10_1, rubygem-rbs 3.4.0-11.el10_1, rubygem-rss 0.3.1-11.el10_1, rubygem-irb 1.13.1-11.el10_1, +15 more
    fixed: vendor fix RHSA-2025:23141
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ruby 3.3.10-11.el10_0, rubygems 3.5.22-11.el10_0, ruby-libs 3.3.10-11.el10_0, rubygem-rbs 3.4.0-11.el10_0, rubygem-rss 0.3.1-11.el10_0, rubygem-irb 1.13.1-11.el10_0, +15 more
    fixed: vendor fix RHSA-2025:23927
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) ruby 3.3.10-5.module+el9.6.0+23780+e40d2335, rubygems 3.5.22-5.module+el9.6.0+23780+e40d2335, ruby-libs 3.3.10-5.module+el9.6.0+23780+e40d2335, rubygem-pg 1.5.4-1.module+el9.4.0+21222+faeeed2f, rubygem-rbs 3.4.0-5.module+el9.6.0+23780+e40d2335, rubygem-rss 0.3.1-5.module+el9.6.0+23780+e40d2335, +17 more
    fixed: vendor fix RHSA-2025:23648
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc 3.3.10-11.el10_1
    fixed: vendor fix RHSA-2025:23141
show 2 more
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) ruby-doc 3.3.10-11.el10_0
    fixed: vendor fix RHSA-2025:23927
  • Red Hat Enterprise Linux 9 ruby, rubygems, ruby-libs, rubygem-irb, rubygem-rbs, rubygem-rss, +13 more Red Hat Enterprise Linux 10 ruby4.0
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
rubygems resolv
<0.2.3
>=0.4.0, <0.6.2
>=0.3.0, <0.3.1
0.2.3
0.6.2
0.3.1

Affected products

  • Ruby resolv

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.