Read the docs
TI-2025-18041 Aliases CVE-2025-24294GHSA-xh69-987w-hrp8

Uncontrolled resource consumption in ruby resolv

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00656 51st percentileScored 2026-11-07
Fix Partial resolv (RubyGems): 0.2.3, 0.6.2, 0.3.1Red Hat: 5 advisoriesRed Hat: 7 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubyresolv0.2 – 0.2.2; 0.3.0 – 0.3.0; 0.6 – 0.6.1—No fix listedCNA
—resolv (RubyGems)before 0.2.30.2.3Patch availableGHSA-xh69-987w-hrp8
—resolv (RubyGems)0.4.0 to before 0.6.20.6.2Patch availableGHSA-xh69-987w-hrp8
—resolv (RubyGems)0.3.0 to before 0.3.10.3.1Patch availableGHSA-xh69-987w-hrp8
  • resolv Vendorruby Affected 0.2 – 0.2.2; 0.3.0 – 0.3.0; 0.6 – 0.6.1 Fixed in — No fix listed CNA
  • resolv (RubyGems) Vendor— Affected before 0.2.3 Fixed in 0.2.3 Patch available GHSA-xh69-987w-hrp8
  • resolv (RubyGems) Vendor— Affected 0.4.0 to before 0.6.2 Fixed in 0.6.2 Patch available GHSA-xh69-987w-hrp8
  • resolv (RubyGems) Vendor— Affected 0.3.0 to before 0.3.1 Fixed in 0.3.1 Patch available GHSA-xh69-987w-hrp8

Remediation

  • Fix · GHSA-xh69-987w-hrp8 resolv (RubyGems) Fixed in 0.2.3 Advisory →
  • Fix · GHSA-xh69-987w-hrp8 resolv (RubyGems) Fixed in 0.6.2 Advisory →
  • Fix · GHSA-xh69-987w-hrp8 resolv (RubyGems) Fixed in 0.3.1 Advisory →

Red Hat 5 advisories

  • RHSA-2025:23927 Released 2025-12-22 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ruby-3.3.10-11.el10_0, ruby-bundled-gems-3.3.10-11.el10_0, ruby-default-gems-3.3.10-11.el10_0 +20
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) ruby-doc-3.3.10-11.el10_0
  • RHSA-2025:23648 Released 2025-12-18 · Red Hat rating Moderate
    ruby:3.3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) ruby-3.3.10-5.module+el9.6.0+23780+e40d2335.aarch64::ruby:3.3, ruby-3.3.10-5.module+el9.6.0+23780+e40d2335.i686::ruby:3.3, ruby-3.3.10-5.module+el9.6.0+23780+e40d2335.ppc64le::ruby:3.3 +47
  • RHSA-2025:23141 Released 2025-12-11 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby-3.3.10-11.el10_1, ruby-bundled-gems-3.3.10-11.el10_1, ruby-default-gems-3.3.10-11.el10_1 +20
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc-3.3.10-11.el10_1
Show 2 more Red Hat advisories
  • RHSA-2025:23062 Released 2025-12-10 · Red Hat rating Moderate
    ruby:3.3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.10-5.module+el8.10.0+23696+c42b0f57.aarch64::ruby:3.3, ruby-3.3.10-5.module+el8.10.0+23696+c42b0f57.i686::ruby:3.3, ruby-3.3.10-5.module+el8.10.0+23696+c42b0f57.ppc64le::ruby:3.3 +47
  • RHSA-2025:23063 Released 2025-12-10 · Red Hat rating Moderate
    ruby:3.3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.10-5.module+el9.7.0+23651+15dc1615.aarch64::ruby:3.3, ruby-3.3.10-5.module+el9.7.0+23651+15dc1615.i686::ruby:3.3, ruby-3.3.10-5.module+el9.7.0+23651+15dc1615.ppc64le::ruby:3.3 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:23141
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:23062
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:23063
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2025:23927
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:23648
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:23141
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2025:23927
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24294
  2. 2026-10-03 Alias added: GHSA-xh69-987w-hrp8
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 5

  • TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-50176 Use after free in ruby json CVSS 4.0HIGH 8.7
  • TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
  • TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
  • TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
  • TI-2025-18855 Net::IMAP vulnerable to possible DoS by memory exhaustion CVSS 3.1MEDIUM 6.5
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences