DNS CVE-2025-24294

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

The vulnerability specifically affects applications using the resolv library for DNS packet parsing. Without CPE data provided, likely affected products include: (1) glibc versions prior to patched releases (affects Linux distributions: Red Hat Enterprise Linux, Ubuntu, Debian, CentOS); (2) musl libc (affects Alpine Linux and embedded systems); (3) Any DNS resolver application: systemd-resolved, BIND (if using vulnerable resolv), Unbound (if using vulnerable underlying library), PowerDNS; (4) Applications with embedded DNS parsing code. Specific version ranges cannot be confirmed without vendor advisories. Users should consult: Red Hat Security Advisories, Ubuntu Security Notices, Debian Security Advisories, glibc release notes, and respective vendor security pages for exact affected version ranges and patch availability.