Medium, CVSS 6.6RubyGemsPublished
resolv vulnerable to DoS via insufficient DNS domain name length validation
CVE-2025-24294 · GHSA-xh69-987w-hrp8
- Affected
- RubyGems resolv < 0.2.3; >= 0.4.0, < 0.6.2; >= 0.3.0, < 0.3.1
- Fixed in
- 0.2.30.3.10.6.2· Vendor fix available
- Issue
- A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. Details The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition. Affected Version The vulnerability affects the resolv gem bundled with the following Ruby series: Ruby 3.2 series: resolv version 0.2.2 and earlier Ruby 3.3 series: resolv version 0.3.0 Ruby 3.4 series: resolv version 0.6.1 and earlier Credits Thanks to Manu for discovering this issue. History Originally published at 2025-07-08 07:00:00 (UTC)
Recommended action: Upgrade to 0.6.2, 0.3.1 or 0.2.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.