Package Instance

REXML has DoS condition when parsing malformed XML file
The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations.
If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

resolv vulnerable to DoS via insufficient DNS domain name length validation
A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby.

## Details
The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting
length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

## Affected Version
The vulnerability affects the resolv gem bundled with the following Ruby series:
* Ruby 3.2 series: resolv version 0.2.2 and earlier
* Ruby 3.3 series: resolv version 0.3.0
* Ruby 3.4 series: resolv version 0.6.1 and earlier

## Credits
Thanks to Manu for discovering this issue.

## History
Originally published at 2025-07-08 07:00:00 (UTC)