Skip to main content

DNS CVE-2025-24294

HIGH
Uncontrolled Resource Consumption (CWE-400)
2025-07-12 support@hackerone.com GHSA-xh69-987w-hrp8
Denial Of Service DNS Red Hat Suse
7.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 7.5 (High) indicates significant impact: Network-based attack (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with availability impact (A:H) but no confidentiality or integrity impact. The attack vector is highly favorable to attackers—any network-accessible service performing DNS resolution can be targeted. However, without EPSS score and KEV enrollment data, real-world prioritization is limited. Key considerations: (1) This is a resource exhaustion vulnerability, not memory corruption, limiting potential for code execution but enabling effective DoS; (2) Automatable via any DNS packet crafting tool, requiring no human interaction; (3) Technical impact is high (service disruption) but contained to availability; (4) Attack complexity is low—no race conditions or specific timing required. If this is actively exploited (KEV status) or has published POC, priority is immediate. If not in KEV and no POC exists, this remains high-priority but not critical—prioritize based on whether affected services are internet-facing.
Exploit ScenarioDerived

An attacker on the internet sends a specially crafted DNS response packet to a target application performing DNS resolution (e.g., a web server resolving domain names, a mail server validating SPF records, or a monitoring system performing DNS lookups). The packet contains a domain name with a pointer chain: the first label points to offset X, which contains a label pointing to offset Y, continuing for dozens or hundreds of iterations. When the resolv library decompresses this name, it follows each pointer sequentially without length validation, consuming CPU cycles in a tight loop. If the pointer chain is sufficiently deep, the decompression process consumes 100% of a single CPU core for extended periods, making that application thread unresponsive. If the application is single-threaded or all threads become occupied with malicious DNS packets (via multiple requests), the entire service becomes unavailable. No exploit kit or POC is necessary—this can be reproduced with standard DNS packet crafting tools (scapy, dnspython, or raw socket code). The attack requires only network access to the target's DNS resolver and no authentication.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

CVE-2025-24294 is a Denial of Service vulnerability in DNS packet parsing libraries (specifically the resolv library) caused by insufficient validation of decompressed domain name lengths. An attacker can send a crafted DNS packet with a highly compressed domain name that, when decompressed, consumes excessive CPU resources without limit, causing the parsing thread to become unresponsive. The vulnerability affects any application using the vulnerable resolv library and has a CVSS score of 7.5 (high severity); real-world exploitation probability and active exploitation status cannot be confirmed without EPSS score and KEV data.

RemediationAI

  1. Patch immediately: Update glibc, musl libc, or affected DNS resolver to patched versions when released by vendors. Check Red Hat, Ubuntu, Debian, and Alpine security advisories for CVE-2025-24294 patch availability. 2. Workarounds (temporary): Implement rate limiting on DNS queries from untrusted sources; deploy DNS query validation at firewall/IDS layer to drop malformed packets with excessive pointer chains; restrict DNS service to trusted networks only. 3. Detection: Monitor DNS resolution threads for CPU spikes and unresponsive processes; implement DNS packet anomaly detection (flag packets with deeply nested pointer chains or decompressed names exceeding 255 octets per RFC 1035). 4. Validation: After patching, verify the resolv library properly enforces a maximum decompressed name length (typically 255 octets per DNS specification) and has bounded decompression loop iterations.

Affected Packages

rubygems resolv fix: 0.2.3, 0.3.1, 0.6.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in DNS packet parsing, specifically in the name decompression mechanism defined in RFC 1035. DNS names in packets use pointer compression to reduce packet size—labels can reference previous portions of the packet via offset pointers. The resolv library implements this decompression but fails to enforce a maximum length limit on the resulting decompressed domain name (CWE-400: Uncontrolled Resource Consumption). An attacker can craft a packet where pointer chains cause exponential expansion during decompression (e.g., pointer A→B→C→D→... creating a deeply nested chain). The library processes this without bounds checking, causing runaway CPU consumption in the decompression loop. This affects any C/C++ application linking against the vulnerable resolv library (typically glibc's DNS resolution functions or musl libc in embedded systems).

Know when DNS gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu MEDIUM
SUSE HIGH
Red Hat 5.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jul 12, 2025 - 04:15 nvd
HIGH 7.5

DescriptionCVE.org

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Executive ViewAI

Why It Matters

A high-severity vulnerability in DNS packet processing could allow attackers to crash applications by sending specially crafted DNS requests, causing service unavailability. This affects any system using the vulnerable resolv library for DNS resolution, potentially impacting customer-facing services and internal infrastructure that depend on DNS functionality.

Business Impact: High
Compensating Controls

Implement DNS query rate limiting and packet size restrictions at network edge (firewall/WAF); disable recursive DNS resolution if not required; segment DNS resolver infrastructure from critical applications; deploy IDS/IPS rules to detect and block malformed DNS decompression packets; implement strict DNS query validation and timeout mechanisms at application layer; monitor CPU utilization on DNS services with automated alerting for anomalies.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in DNS

View all
CVE-2026-24054 CRITICAL POC
10.0 Jan 29

Sandbox escape in Kata Containers allowing guest VM to access host resources. CVSS 10.0 — undermines the core security g
CVE-2019-25361 CRITICAL POC
9.8 Feb 18

Buffer overflow in Ayukov NFTP client 1.71 in SYST command handling allows remote FTP servers to execute arbitrary code

CVE-2019-25327 CRITICAL POC
9.8 Feb 12

Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.
CVE-2019-25319 CRITICAL POC
9.8 Feb 12

Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.
CVE-2020-37095 CRITICAL POC
9.8 Feb 07

Cyberoam Authentication Client 2.1.2.7 has a buffer overflow allowing remote attackers to execute code through the netwo
CVE-2021-47774 CRITICAL POC
9.8 Jan 15

Kingdia CD Extractor 3.0.2 has a buffer overflow in the registration name field. PoC available.
CVE-2021-47785 CRITICAL POC
9.8 Jan 16

Ether MP3 CD Burner 1.3.8 has buffer overflow in registration enabling bind shell on port 3110 via SEH overwrite. PoC av
CVE-2019-25362 CRITICAL POC
9.8 Feb 18

Buffer overflow in WMV to AVI MPEG DVD Convertor 4.6.1217 allows code execution via crafted media files. PoC available.
CVE-2020-37119 CRITICAL POC
9.8 Feb 05

Stack-based buffer overflow in Nsauditor Network Auditing Tool 3.0.28 and 3.2.1.0 in the DNS Lookup tool allows attacker
CVE-2026-2186 HIGH POC
8.8 Feb 08

Stack-based buffer overflow in Tenda RX3 firmware 16.03.13.11 allows authenticated remote attackers to achieve full syst
CVE-2026-3379 HIGH POC
8.8 Mar 01

Remote code execution in Tenda F453 1.0.0.3 DNS firmware via a buffer overflow in the /goform/SetIpBind endpoint allows

CVE-2019-25318 HIGH POC
8.8 Feb 12

AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
ruby2.3
Release Status Version
xenial needs-triage -
jammy DNE -
noble DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
ruby2.5
Release Status Version
jammy DNE -
noble DNE -
plucky DNE -
upstream needs-triage -
bionic released 2.5.1-1ubuntu1.16+esm5
questing DNE -
ruby2.7
Release Status Version
jammy DNE -
noble DNE -
plucky DNE -
upstream needs-triage -
focal released 2.7.0-5ubuntu1.18+esm1
questing DNE -
ruby3.0
Release Status Version
noble DNE -
plucky DNE -
upstream needs-triage -
jammy released 3.0.2-7ubuntu2.11
questing DNE -
ruby3.2
Release Status Version
jammy DNE -
plucky DNE -
upstream released 3.2.9
noble released 3.2.3-1ubuntu0.24.04.6
questing DNE -
ruby3.3
Release Status Version
jammy DNE -
noble DNE -
upstream released 3.3.9
plucky released 3.3.7-1ubuntu2.1
questing released 3.3.8-2ubuntu2
jruby
Release Status Version
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
jammy DNE -
noble needs-triage -
upstream needs-triage -
plucky ignored end of life, was needs-triage
questing needs-triage -
rubygems
Release Status Version
upstream needs-triage -
jammy not-affected code not present
noble not-affected code not present
plucky released 3.6.3-1ubuntu0.1
questing released 3.6.7-2ubuntu1
USN-7735-1 USN-7734-1

Debian

Bug #1109337
ruby2.7
Release Status Fixed Version Urgency
bullseye vulnerable 2.7.4-1+deb11u1 -
bullseye (security) vulnerable 2.7.4-1+deb11u5 -
(unstable) fixed (unfixed) -
ruby3.1
Release Status Fixed Version Urgency
bookworm, bookworm (security) vulnerable 3.1.2-7+deb12u1 -
(unstable) fixed (unfixed) -
ruby3.3
Release Status Fixed Version Urgency
forky, sid, trixie vulnerable 3.3.8-2 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Azure-3P Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-EC2 Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-3P Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-BYOS-GCE Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAP-Hardened Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP6-SAP-Hardened-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-EC2 Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:23062 ADVISORY https://access.redhat.com/errata/RHSA-2025:23063 ADVISORY https://access.redhat.com/errata/RHSA-2025:23141 ADVISORY https://access.redhat.com/errata/RHSA-2025:23648 ADVISORY https://access.redhat.com/errata/RHSA-2025:23927 ADVISORY https://ubuntu.com/security/notices/USN-7734-1 ADVISORY https://ubuntu.com/security/notices/USN-7735-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3776/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4264/ REF https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy