CVE-2025-24294: High severity rubygems/resolv vulnerability
A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby.
Details The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.
An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.
This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
Affected Version The vulnerability affects the resolv gem bundled with the following Ruby series: Ruby 3.2 series: resolv version 0.2.2 and earlier Ruby 3.3 series: resolv version 0.3.0 Ruby 3.4 series: resolv version 0.6.1 and earlier
Credits Thanks to Manu for discovering this issue.
History Originally published at 2025-07-08 07:00:00 (UTC)
Other sources
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.
An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.
This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/resolvto a version that resolves this vulnerability.Fixed in 0.3.1 - Upgrade
Upgrade
rubygems/resolvto a version that resolves this vulnerability.Fixed in 0.6.2 - Upgrade
Upgrade
rubygems/resolvto a version that resolves this vulnerability.Fixed in 0.2.3 - Upgrade
Upgrade
debian/ruby3.3to a version that resolves this vulnerability.Fixed in 3.3.13-0+deb13u1 - Upgrade
Upgrade
resolv gem (bundled with Ruby)to a version that resolves this vulnerability.Fixed in 0.2.2 - Upgrade
Upgrade
resolv gem (bundled with Ruby)to a version that resolves this vulnerability.Fixed in 0.3.0 - Upgrade
Upgrade
resolv gem (bundled with Ruby)to a version that resolves this vulnerability.Fixed in 0.6.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24294?
CVE-2025-24294 is classified as a denial of service vulnerability that can disrupt service availability.
How do I fix CVE-2025-24294?
To fix CVE-2025-24294, update the resolv gem to versions 0.3.1, 0.6.2, or later.
Which versions of the resolv gem are affected by CVE-2025-24294?
CVE-2025-24294 affects resolv gem versions between 0.3.0 and 0.3.1, 0.4.0 up to 0.6.2, and all versions prior to 0.2.3.
What type of attack can exploit CVE-2025-24294?
CVE-2025-24294 can be exploited by an attacker sending a crafted DNS packet that causes a denial of service.
Is the resolv gem the only software affected by CVE-2025-24294?
Yes, CVE-2025-24294 specifically impacts the resolv gem bundled with Ruby.