Improper Validation of Specified Quantity in Input

Overview resolv is a Thread-aware DNS resolver library in Ruby. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the getlabels function in the resolv.rb file. An attacker can cause excessive CPU resource consumption and make the applicatio...

CVE-2025-24294

The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses suc...

A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

...

Possible Denial of Service in resolv gem

A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2025-24294. We recommend upgrading the resolv gem. Details The vulnerability is caused by an insufficient check on the length of a decompressed...

rubygem-resolv -- Possible denial of service

Manu reports: The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process...

PT-2025-28418 · Ruby +1 · Resolve +2

Name of the Vulnerable Software and Affected Versions: Ruby affected versions not specified Description: The issue is related to a possible Denial of Service in the resolv gem. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents...

Possible Denial of Service in resolv gem

A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby. The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name...

Malicious code in capistrano-scm-git-with_submodule_and_resolv_symlinks (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

SUSE CVE-2024-24476

A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addrresolv.c, and wsmanuflookupstr, size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected...

AZL-44619 CVE-2024-24476 affecting package wireshark for versions less than 4.4.7-1

A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addrresolv.c, and wsmanuflookupstr, size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected...

ASB-A-278303745

In discoverythread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

K03125360: F5 iRules 'RESOLV::lookup' command vulnerability CVE-2020-5941

Security Advisory Description Using the RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel TMM to generate a core file and restart. This issue occurs when data exceeding the maximum limit of a host name passes to the RESOLV::lookup command. CVE-2020-5941 Impact Th...

K52638558: RESOLV::lookup iRule command vulnerability CVE-2016-6876

Security Advisory Description A specially crafted reply to DNS queries from RESOLV::lookup may consume excess system resources or possibly lead to a crash and failover. CVE-2016-6876 Impact The BIG-IP system may consume excess system resources, or experience a Traffic Management Microkernel TMM...

SUSE CVE-2005-0205

KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of...

SUSE CVE-2017-17790

The lazyinitialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernelopen, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input ma...

SUSE CVE-2020-17440

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that parses incoming DNS packets does not validate that domain names present in the DNS responses have '\0' termination. This results in errors when calculating the offset of the pointer that jumps over domain...

SUSE CVE-2021-43816

containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface CRI, an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any...

ruby:2.6 security, bug fix, and enhancement update

ruby 2.6.7-107 - Upgrade to Ruby 2.6.7. Resolves: rhbz1952627 - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address containing leading zero Resolves: rhbz1954968 - Fix: Rubygem-bundler: Don't use insecure tmp directory as home allows for execution of malicious code. Resolves:...

ruby:2.5 security, bug fix, and enhancement update

ruby 2.5.9-107 - Update to Ruby 2.5.9. Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed Resolves: rhbz1952626 - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero Resolves: rhbz1955010...

Moderate: Red Hat Security Advisory: ruby:2.7 security, bug fix, and enhancement update

An update for the ruby:2.7 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...