The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-bundled-gemsUpgrade ruby-docUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygemsUpgrade rubygem-irbUpgrade rubyUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-abrt-docUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-rdocUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-test-unitUpgrade rubygem-pg | Jan 8, 2026 | Dec 10, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ruby-develUpgrade ruby-irbUpgrade rubygem-minitestUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade ruby-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2Upgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-libsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-default-gems | Aug 5, 2025 | Jul 12, 2025 |
| Debian | — | Upgrade ruby2.7No solution exists | Jul 16, 2025 | Jul 12, 2025 |
| Freebsd | — | Upgrade ruby32Upgrade ruby35Upgrade rubygem-resolvUpgrade ruby33Upgrade ruby34Upgrade ruby | Jul 26, 2025 | Jul 25, 2025 |
| Oracle_linux | — | Upgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-test-unitUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade rubygem-rssUpgrade rubyUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade rubygem-mysql2Upgrade rubygems-develUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-minitest | Dec 15, 2025 | Jul 12, 2025 |
| Redhat_linux | — | Upgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrtUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-docNo solution existsUpgrade ruby-develUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-rssUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-rbs-debuginfoUpgrade rubygem-raccUpgrade rubygem-psychUpgrade rubygem-pg-debuginfoUpgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rexmlUpgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-racc-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-test-unitUpgrade ruby-debugsource | Jul 17, 2025 | Jul 12, 2025 |
| Rocky_linux | — | Upgrade rubygem-pgUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade rubygem-io-console-debuginfoUpgrade ruby-devel | Feb 5, 2026 | Jan 3, 2026 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade ruby2.5-devel | Dec 5, 2025 | Oct 24, 2025 |
| Ubuntu | — | Upgrade ruby2.7 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.3Upgrade ruby-rubygemsUpgrade ruby3.0Upgrade libruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.2 | Jul 25, 2025 | Jul 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub