rubygem-resolv -- Possible denial of service

2025-07-25 · CVE-2025-24294 · VuXML entry

Manu reports: The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource …

Affected versions

• rubygem-resolv < 0.6.2
• ruby >= 3.2.0.p1,1 < 3.2.9,1; >= 3.3.0.p1,1 < 3.3.9,1; >= 3.4.0.p1,1 < 3.4.5,1; >= 3.5.0.p1,1 < 3.5.0.p2,1
• ruby32 < 3.2.9,1
• ruby33 < 3.3.9,1
• ruby34 < 3.4.5,1
• ruby35 < 3.5.0.p2,1

By system

3 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.