The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a…

Description

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Timeline

Scores

EPSS (exploitation in 30 days)

0.66% · top 48% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-400 Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs

Affected products

• Ruby · resolv

  • affected 0.2 – ≤ 0.2.2
  • affected 0.3.0 – ≤ 0.3.0
  • affected 0.6 – ≤ 0.6.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• RubyGemsresolvGHSA-xh69-987w-hrp8 (opens in a new tab)

References (1)

• https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/ (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-xh69-987w-hrp8 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-24294](https://trackcve.app/badge/CVE-2025-24294.svg)](https://trackcve.app/cve/CVE-2025-24294)

Record last updated 16 Jul 2025, 13:37 UTC.