The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade rubygem-rbsUpgrade rubygem-typeprofUpgrade ruby-develUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade ruby-default-gemsUpgrade rubygem-rssUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-mysql2-docUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-raccUpgrade ruby-docUpgrade ruby-bundled-gemsUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade ruby-libs | Jan 8, 2026 | Dec 10, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade ruby-develUpgrade rubyUpgrade ruby-libsUpgrade rubygem-rake | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygemsUpgrade ruby3.2-libsUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rdoc | Aug 5, 2025 | Jul 12, 2025 |
| Debian | — | Upgrade ruby2.7No solution exists | Jul 16, 2025 | Jul 12, 2025 |
| Freebsd | — | Upgrade rubyUpgrade rubygem-resolvUpgrade ruby33Upgrade ruby32Upgrade ruby34Upgrade ruby35 | Jul 26, 2025 | Jul 25, 2025 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-rexmlUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-raccUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-mysql2-doc | Dec 15, 2025 | Jul 12, 2025 |
| Redhat_linux | — | Upgrade rubygem-typeprofUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade rubygem-racc-debuginfoUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bundlerNo solution existsUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade ruby-docUpgrade rubygem-pg-docUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-psych-debuginfoUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubygem-io-console-debuginfoUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gems | Jul 17, 2025 | Jul 12, 2025 |
| Rocky_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-pg-debuginfoUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rbsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfo | Feb 5, 2026 | Jan 3, 2026 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5-stdlib | Dec 5, 2025 | Oct 24, 2025 |
| Ubuntu | — | Upgrade ruby3.2Upgrade libruby3.0Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby-rubygemsUpgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby2.7 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.3 | Jul 25, 2025 | Jul 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub