Resource exhaustion in resolv - CVE-2025-24294

Vulnerability identifier: #VU114812

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-24294

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling DNS packets. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

resolv
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Basesystem Module
openSUSE Leap
Ubuntu
Netcool Operations Insight
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rubygem-rss
rubygem-abrt-doc
rubygem-abrt
rubygem-mysql2-doc
rubygem-mysql2
rubygem-io-console
rubygem-typeprof
rubygem-pg-doc
rubygem-pg
rubygem-racc
rubygem-irb
rubygem-power_assert
ruby2.5 (Ubuntu package)
ruby2.5-devel
ruby2.5-doc-ri
libruby2_5-2_5-debuginfo
libruby2_5-2_5
ruby2.5-debuginfo
ruby2.5-stdlib-debuginfo
ruby2.5-debugsource
ruby2.5-stdlib
ruby2.5-doc
ruby2.5-devel-extra
ruby2.5
rubygem-bundler
rubygem-json
rubygem-bigdecimal
rubygems (Ubuntu package)
ruby
ruby-default-gems
ruby-doc
ruby-libs
ruby-devel
ruby-bundled-gems
ruby (Red Hat package)
rubygem-rbs
rubygem-rexml
rubygems
rubygems-devel
rubygem-test-unit
rubygem-psych
rubygem-minitest
rubygem-rdoc
rubygem-rake
Astronomer with IBM
ExtremeControl for Site Engine

Install updates from vendor's website.

resolv - addressed in versions 0.2.3, 0.3.1, 0.6.2
Netcool Operations Insight - update to 1.6.15
rubygem-rss - update to 0.3.1-5
rubygem-abrt-doc - update to 0.4.0-1
rubygem-abrt - update to 0.4.0-1
rubygem-mysql2-doc - update to 0.5.5-1
rubygem-mysql2 - update to 0.5.5-1
rubygem-io-console - update to 0.7.1-5
rubygem-typeprof - update to 0.21.9-5
Astronomer with IBM - update to 1.1.0
rubygem-pg-doc - update to 1.5.4-1
rubygem-pg - update to 1.5.4-1
rubygem-racc - update to 1.7.3-5
rubygem-irb - update to 1.13.1-5
rubygem-power_assert - update to 2.0.3-5
ruby2.5 (Ubuntu package) - addressed in versions 2.5.1-1ubuntu1.16+esm5, 2.7.0-5ubuntu1.18+esm1, 3.0.2-7ubuntu2.11, 3.2.3-1ubuntu0.24.04.6, 3.3.7-1ubuntu2.1
ruby2.5-devel - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
ruby2.5-doc-ri - update to 2.5.9-150000.4.54.1
libruby2_5-2_5-debuginfo - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
libruby2_5-2_5 - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
ruby2.5-debuginfo - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
ruby2.5-stdlib-debuginfo - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
ruby2.5-debugsource - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
ruby2.5-stdlib - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
ruby2.5-doc - update to 2.5.9-150000.4.54.1
ruby2.5-devel-extra - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
ruby2.5 - addressed in versions 2.5.9-150000.4.54.1, 2.5.9-150700.24.3.1
rubygem-bundler - update to 2.5.22-5
rubygem-json - update to 2.7.2-5
rubygem-bigdecimal - update to 3.1.5-5
rubygems (Ubuntu package) - addressed in versions 3.3.5-2ubuntu1.1, 3.6.3-1ubuntu0.1
ruby - update to 3.3.10-5
ruby-default-gems - update to 3.3.10-5
ruby-doc - update to 3.3.10-5
ruby-libs - update to 3.3.10-5
ruby-devel - update to 3.3.10-5
ruby-bundled-gems - update to 3.3.10-5
ruby (Red Hat package) - addressed in versions 3.3.10-11.el10_0, 3.3.10-11.el10_1
rubygem-rbs - update to 3.4.0-5
rubygem-rexml - update to 3.4.4-5
rubygems - update to 3.5.22-5
rubygems-devel - update to 3.5.22-5
rubygem-test-unit - update to 3.6.1-5
rubygem-psych - update to 5.1.2-5
rubygem-minitest - update to 5.20.0-5
rubygem-rdoc - update to 6.6.3.1-5
rubygem-rake - update to 13.1.0-5
ExtremeControl for Site Engine - update to 25.08.12

• https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/

• Remote denial of service in Ruby resolv gem
• Ubuntu update for rubygems
• Ubuntu update for ruby2.5
• ExtremeControl for Site Engine update for Ruby resolv gem
• SUSE update for ruby2.5
• Astronomer with IBM update for resolv package
• Multiple vulnerabilities in Netcool Operations Insight
• SUSE update for ruby2.5
• Red Hat Enterprise Linux 9 update for the ruby:3.3 module
• Red Hat Enterprise Linux 10 update for ruby
• Red Hat Enterprise Linux 9 update for the ruby:3.3 module
• Red Hat Enterprise Linux 10 update for ruby
• Anolis OS update for ruby:3.3 module