N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-24294

CVE-2025-24294: resolv vulnerable to DoS via insufficient DNS domain name length validation

A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby.

Details

The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Affected Version

The vulnerability affects the resolv gem bundled with the following Ruby series:

Ruby 3.2 series: resolv version 0.2.2 and earlier
Ruby 3.3 series: resolv version 0.3.0
Ruby 3.4 series: resolv version 0.6.1 and earlier

Credits

Thanks to Manu for discovering this issue.

History

Originally published at 2025-07-08 07:00:00 (UTC)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-24294

CVE-2025-24294:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
resolv	rubygems	< 0.2.3	0.2.3
resolv	rubygems	>= 0.4.0, < 0.6.2	0.6.2
resolv	rubygems	>= 0.3.0, < 0.3.1	0.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in the resolv gem, caused by insufficient validation of the length of a decompressed domain name from a DNS packet. The analysis of the patch commit 4c2f71b5e80826506f78417d85b38481c058fb25 reveals the exact location of the vulnerability.

The core of the issue lies within the get_labels method of the private MessageDecoder class, which is used by Resolv::DNS::Message. This method was modified to add a size check (size += 1 + l.string.bytesize) and a validation (raise DecodeError.new("name label data exceed 255 octets") if size > 255) that was previously missing. This allowed a crafted DNS packet with a highly compressed domain name to cause excessive CPU usage during decompression.

The public-facing method that triggers this vulnerable logic is Resolv::DNS::Message.decode, as confirmed by the new test case test_too_long_address added in the patch. This test explicitly calls Resolv::DNS::Message.decode with a malicious payload to ensure the fix works as expected.

Therefore, during exploitation, a runtime profiler would show Resolv::DNS::Message.decode as the entry point, which in turn calls the vulnerable get_labels method (and get_label within it) in a loop, leading to the denial of service. All three functions are key indicators of this vulnerability being triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-24294: resolv vulnerable to DoS via insufficient DNS domain name length validation

Details

Affected Version

Credits

History

CVE-2025-24294:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-24294: resolv vulnerable to DoS via insufficient DNS domain name length validation

Details

Affected Version

Credits

History

Technical Details

N/A

N/A

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI