7.5

CVE-2025-24294: ruby resolv Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighDeferred
AliasesSUSE-SU-2025:3776-1UBUNTU-CVE-2025-24294DEBIAN-CVE-2025-24294
Published 12-07-2025Last modified 16-07-2025
Open JSON

Vulnerability summary

CVE-2025-24294 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in ruby resolv. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.4% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.66%
0%100%
Low · +0.09 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 5
RHSA-2025:23062RHSA-2025:23063RHSA-2025:23141RHSA-2025:23648RHSA-2025:23927SUSE-SU-2025:4264-1

Timeline

  1. 12-07-2025
    PublishedVulnerability first disclosed.
  2. 16-07-2025
    Last modifiedVulnerability information updated.

Description

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

CVSS metrics

10 scores · 7 sources · 2 versions

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

+0.09 pp

From 0.56% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard14 products
  • graalvm-24-trufflerubyAll versions (No fix recorded)
  • jruby-9.4< 9.4.13.0-r1
  • jruby-9.4-default-ruby< 9.4.13.0-r1
  • ruby-3.1All versions (No fix recorded)
  • ruby-3.1-devAll versions (No fix recorded)
Wolfi12 products
  • jruby-9.4< 9.4.13.0-r1
  • jruby-9.4-default-ruby< 9.4.13.0-r1
  • ruby-3.1All versions (No fix recorded)
  • ruby-3.1-devAll versions (No fix recorded)
  • ruby-3.2< 3.2.8-r3
Ubuntu8 products
  • jrubyAll versions (No fix recorded)
  • ruby2.3All versions (No fix recorded)
  • ruby2.5< 2.5.1-1ubuntu1.16+esm5
  • ruby2.7< 2.7.0-5ubuntu1.18+esm1
  • ruby3.0< 3.0.2-7ubuntu2.11
Debian2 products
  • ruby3.1All versions (No fix recorded)
  • ruby3.3All versions (No fix recorded)
Opensuse1 product
  • ruby2.5&distro=openSUSE Leap 15.6< 2.5.9-150000.4.54.1
Ruby1 product
  • resolv≥ 0.2, ≤ 0.2.2 | 0.3.0 | ≥ 0.6, ≤ 0.6.1
RubyGems1 product
  • resolv< 0.2.3 | ≥ 0.4.0, < 0.6.2 | ≥ 0.3.0, < 0.3.1
Suse1 product
  • ruby2.5&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6< 2.5.9-150000.4.54.1

8 vendors · 40 products

References

14 links
Show all 14 references