CVE-2025-24294 - CVE House
Back to Database
Status published Unknown CVE-2025-24294

The attack vector is a potential Denial of Service (DoS)....

Vulnerability Description

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24294

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ruby

View All →
CVE-2025-6442
Ruby WEBrick read_header HTTP Request Smuggling Vulnerability
Medium 6.5
CVE-2016-2339
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize"...
Critical 9.8
CVE-2016-2337
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker...
Critical 9.8
CVE-2016-2336
Type confusion exists in two methods of Ruby's WIN32OLE class,...
Critical 9.8
CVE-2015-1855
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel...
Medium 5.9

Affected Vendor

Affected Software

resolv
Vulnerable Versions:
0.2, 0.3.0, 0.6

Timeline

Official Publish: July 12th, 2025
Last Modified: July 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.