{"schema_version":"1.7.3","id":"GHSA-xh69-987w-hrp8","published":"2025-07-15T14:37:08Z","modified":"2026-02-04T02:31:33.534629Z","aliases":["CVE-2025-24294"],"related":["CGA-6785-c33m-x6p8"],"summary":"resolv vulnerable to DoS via insufficient DNS domain name length validation","details":"A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby.\n\n## Details\nThe vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.\n\nAn attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting\nlength of the name.\n\nThis resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.\n\n## Affected Version\nThe vulnerability affects the resolv gem bundled with the following Ruby series:\n* Ruby 3.2 series: resolv version 0.2.2 and earlier\n* Ruby 3.3 series: resolv version 0.3.0\n* Ruby 3.4 series: resolv version 0.6.1 and earlier\n\n## Credits\nThanks to Manu for discovering this issue.\n\n## History\nOriginally published at 2025-07-08 07:00:00 (UTC)","affected":[{"package":{"name":"resolv","ecosystem":"RubyGems","purl":"pkg:gem/resolv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-xh69-987w-hrp8/GHSA-xh69-987w-hrp8.json"}},{"package":{"name":"resolv","ecosystem":"RubyGems","purl":"pkg:gem/resolv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.6.2"}]}],"versions":["0.4.0","0.5.0","0.6.0","0.6.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-xh69-987w-hrp8/GHSA-xh69-987w-hrp8.json"}},{"package":{"name":"resolv","ecosystem":"RubyGems","purl":"pkg:gem/resolv"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.1"}]}],"versions":["0.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-xh69-987w-hrp8/GHSA-xh69-987w-hrp8.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24294"},{"type":"WEB","url":"https://github.com/ruby/resolv/commit/4c2f71b5e80826506f78417d85b38481c058fb25"},{"type":"PACKAGE","url":"https://github.com/ruby/resolv"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/resolv/CVE-2025-24294.yml"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294"}],"database_specific":{"cwe_ids":["CWE-1284","CWE-400"],"github_reviewed":true,"github_reviewed_at":"2025-07-15T14:37:08Z","nvd_published_at":"2025-07-12T04:15:46Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}]}