CVE-2025-24294
- Source
- https://cve.org/CVERecord?id=CVE-2025-24294
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-24294.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-24294
- Aliases
- Downstream
BELL (1)
CGA (40)
- CGA-27hr-9xp5-qwpw
- CGA-2gx6-pp87-99x2
- CGA-2j3v-g3mq-jf5f
- CGA-2jgq-fj6j-wm9h
- CGA-2rfx-gq87-q98p
- CGA-39xj-f73c-qr32
- CGA-3qw8-2692-567c
- CGA-4q6r-2frh-45g9
- CGA-4v5r-wv8h-6ch2
- CGA-5pw6-47ff-xj68
- CGA-5x24-2qp9-r3vx
- CGA-627x-443f-cjqx
- CGA-6q3x-w6rw-6f8g
- CGA-7845-j63v-gqxr
- CGA-8262-63r8-cr5m
- CGA-8wpq-cg73-2mvr
- CGA-98hv-6g8r-xr2g
- CGA-9g57-mhjg-2x3j
- CGA-9v49-669c-r6hc
- CGA-chph-2wpw-xh7r
- CGA-cwhj-96xc-xcgh
- CGA-fpvr-q8p8-r5g9
- CGA-g5m9-wqhx-5rh7
- CGA-hfq7-7vcv-3hrq
- CGA-hmjj-fppm-9mxh
- CGA-j3x6-3rvg-9g9g
- CGA-jhmp-2qj4-x29f
- CGA-jxjp-r75h-32fj
- CGA-p5gx-jjrf-5rh2
- CGA-p62r-x73v-2h72
- CGA-p9cc-c4w9-7qp6
- CGA-prm7-hgr2-973p
- CGA-q5wf-6gv5-5c6r
- CGA-q9gc-vrv5-qx7q
- CGA-r5jm-25q9-3w4x
- CGA-r5w4-xg6g-3h4c
- CGA-rcg3-3rg5-53c5
- CGA-rrwj-h56p-v22g
- CGA-v82x-pcq4-4pwj
- CGA-x6wr-6fgm-g9v3
DEBIAN (1)
ECHO (1)
MINI (6)
- Related
- Withdrawn
- 2026-01-27T04:19:57Z
- Published
- 2025-07-12T04:15:46Z
- Modified
- 2026-07-17T21:03:58Z
- Summary
- [none]
- Details
-
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.
An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.
This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
- References