The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade rubygem-raccUpgrade ruby-docUpgrade ruby-bundled-gemsUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygemsUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-abrt | Jan 8, 2026 | Dec 10, 2025 |
| Amazon Linux Ami 2 | — | Upgrade rubygem-minitestUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-bigdecimal | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2Upgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-develUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-docUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-minitest | Aug 5, 2025 | Jul 12, 2025 |
| Debian | — | No solution existsUpgrade ruby2.7 | Jul 16, 2025 | Jul 12, 2025 |
| Freebsd | — | Upgrade rubyUpgrade rubygem-resolvUpgrade ruby34Upgrade ruby35Upgrade ruby32Upgrade ruby33 | Jul 26, 2025 | Jul 25, 2025 |
| Oracle_linux | — | Upgrade rubygem-rexmlUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-abrt-docUpgrade rubygem-rbsUpgrade ruby-default-gemsUpgrade rubygem-jsonUpgrade rubygem-typeprofUpgrade rubygem-rssUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-raccUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade ruby-doc | Dec 15, 2025 | Jul 12, 2025 |
| Redhat_linux | — | Upgrade rubygem-raccUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-bigdecimal-debuginfoUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-rdocNo solution existsUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-rssUpgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2-debuginfoUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-json | Jul 17, 2025 | Jul 12, 2025 |
| Rocky_linux | — | Upgrade rubygem-rbsUpgrade rubygem-raccUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-racc-debuginfo | Feb 5, 2026 | Jan 3, 2026 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5Upgrade ruby2.5-devel | Dec 5, 2025 | Oct 24, 2025 |
| Ubuntu | — | Upgrade ruby3.0Upgrade libruby3.0Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby-rubygemsUpgrade libruby3.3Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby2.7 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro) | Jul 25, 2025 | Jul 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub