CVE-2025-24294 — Uncontrolled Resource Consumption in Resolv
Severity
7.5HIGHNVD
OSV9.8OSV5.3
EPSS
0.1%
top 74.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 12
Latest updateSep 3
Description
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.
An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.
This resource consumption can cause the applicatio…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages9 packages
🔴Vulnerability Details
5📋Vendor Advisories
5Microsoft▶
CVE-2025-24294: FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One↗2025-07-08
Debian▶
CVE-2025-24294: ruby2.7 - The attack vector is a potential Denial of Service (DoS). The vulnerability is c...↗2025