CVE-2025-24294

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Uncontrolled Resource Consumption. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Rincian

Terbit di NVD

12 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/