The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-raccUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade ruby-default-gemsUpgrade rubygem-rbsUpgrade rubygem-bundlerUpgrade rubygem-rdoc | Jan 8, 2026 | Dec 10, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ruby-debuginfoUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-rakeUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade ruby-tcltk | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2Upgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygemsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-io-console-debuginfo | Aug 5, 2025 | Jul 12, 2025 |
| Debian | — | No solution existsUpgrade ruby2.7 | Jul 16, 2025 | Jul 12, 2025 |
| Freebsd | — | Upgrade rubyUpgrade ruby33Upgrade ruby35Upgrade ruby34Upgrade rubygem-resolvUpgrade ruby32 | Jul 26, 2025 | Jul 25, 2025 |
| Oracle_linux | — | Upgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-raccUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-rbsUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-test-unit | Dec 15, 2025 | Jul 12, 2025 |
| Redhat_linux | — | Upgrade rubyUpgrade rubygemsUpgrade rubygem-abrtUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-default-gemsNo solution existsUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubygem-rssUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-rexmlUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-raccUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debuginfo | Jul 17, 2025 | Jul 12, 2025 |
| Rocky_linux | — | Upgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-racc-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bigdecimal-debuginfo | Feb 5, 2026 | Jan 3, 2026 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade ruby2.5-devel | Dec 5, 2025 | Oct 24, 2025 |
| Ubuntu | — | Upgrade ruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby2.7 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby-rubygemsUpgrade ruby3.2Upgrade ruby3.0Upgrade libruby3.2Upgrade libruby2.5 (Ubuntu Pro) | Jul 25, 2025 | Jul 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub