HIGH 7.5 Microsoft

CVE-2025-24294

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Microsoft Security Update 2025-Jul: The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

Affected Products

References

Published: 2025-07-08 · Source: Microsoft · Feed updated: 2026-08-04
This high severity vulnerability with a CVSS score of 7.5 was published on 2025-07-08 via Microsoft. Affected: cbl2 ruby 3.1.7-2 on CBL Mariner 2.0, cbl2 ruby 3.1.7-3 on CBL Mariner 2.0, azl3 ruby 3.3.5-5 on Azure Linux 3.0.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.