CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2025-24294
High (7.5). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in resolv 0.2.3, 0.3.1, 0.6.2.
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.
An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.
This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xh69-987w-hrp8 | RubyGems | resolv | <0.2.3 | 0.2.3 |
| GHSA-xh69-987w-hrp8 | RubyGems | resolv | >=0.4.0 <0.6.2 | 0.6.2 |
| GHSA-xh69-987w-hrp8 | RubyGems | resolv | >=0.3.0 <0.3.1 | 0.3.1 |