Denial of Service Vulnerability in JRuby and Ruby Packages
Summary
UBUNTU-CVE-2025-24294: The attack vector is a potential Denial of Service (DoS). Affects jruby versions 1.5.6-5ubuntu1 – 1.5.6-9+deb8u2build0.14.04.1~esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JRuby is an implementation of the Ruby programming language that runs on the Java Virtual Machine (JVM). It allows Ruby applications to leverage Java libraries and provides a platform for running Ruby code in a Java environment. Ruby, a dynamic, open-source programming language, is widely used for web development and scripting. The vulnerability in question affects various versions of JRuby and Ruby packages, specifically those that handle DNS packet processing. This vulnerability can lead to a Denial of Service (DoS) condition, making applications unresponsive.
Vulnerability Detail
The vulnerability arises from an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes excessive CPU resources, as the library does not limit the resulting length of the name. This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on DNS requests to mitigate the impact of potential attacks. This can help reduce the likelihood of resource exhaustion caused by malicious DNS packets.
Conclusion
In summary, the vulnerability in JRuby and Ruby packages poses a significant risk of Denial of Service due to improper DNS packet handling. It is crucial to update the affected packages to their patched versions to mitigate this risk. Additionally, implementing temporary workarounds can help protect applications until updates can be applied.
See every vulnerability recorded for jruby →
FAQ
The vulnerability is a Denial of Service (DoS) issue caused by improper handling of DNS packet decompression.
The affected packages include various versions of JRuby and Ruby, specifically those listed in the vulnerability details.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If immediate updates are not possible, implement rate limiting on DNS requests as a temporary workaround to mitigate the risk.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
