From =?UTF-8?Q?Moritz_M=C3=BChlenhoff?=@21:1/5 to All on Tue Jul 15 14:40:02 2025
Package: ruby3.3
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for ruby3.3.
CVE-2025-24294[0]:
| The attack vector is a potential Denial of Service (DoS). The
| vulnerability is caused by an insufficient check on the length of a
| decompressed domain name within a DNS packet. An attacker can
| craft a malicious DNS packet containing a highly compressed domain
| name. When the resolv library parses such a packet, the name
| decompression process consumes a large amount of CPU resources, as
| the library does not limit the resulting length of the name. This
| resource consumption can cause the application thread to become
| unresponsive, resulting in a Denial of Service condition.