Homepage

CVE-2025-24294 The advisory has been revoked - it doesn't affect any version of package ruby-libs  (opens in a new tab)

Threat Intelligence

EPSS
0.66% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-RUBYLIBS-14872176
  • published6 Jan 2026
  • disclosed10 Dec 2025
Report a new vulnerability Found a mistake?

Introduced: 10 Dec 2025

CVE-2025-24294  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ruby-libs package and not the ruby-libs package as distributed by AlmaLinux.

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.