CVE-2025-24294

Executive Summary

CVE-2025-24294 is a Denial of Service (DoS) vulnerability located in the name decompression logic of a DNS resolv library (likely libc resolv or a third-party resolver). The flaw stems from an insufficient length check on decompressed domain names within DNS packets, allowing a specially crafted, highly compressed DNS name to consume excessive CPU resources during parsing. This causes the calling application thread to become unresponsive, leading to a DoS condition. The vulnerability affects any application that relies on the vulnerable resolv library for DNS resolution, with no public exploit code currently confirmed. A patch is claimed by a single source, though the specific vendor and fixed version remain unconfirmed, and no CISA KEV listing exists to date.

Technical Analysis

The vulnerability resides in the domain name decompression routine within a DNS parsing library. DNS wire format uses compression pointers (RFC 1035, section 4.1.4) to reduce packet size. A compression pointer is a two-byte sequence (0xC0 followed by an offset) that instructs the parser to jump to a prior location in the message. The parser must account for the expanded name length to prevent CPU exhaustion via recursive or iterative decompression.

In CVE-2025-24294, the vulnerable implementation fails to enforce a maximum length on the decompressed domain name. An attacker can craft a DNS packet where the name field contains a chain of compression pointers that, when fully expanded, produces a string far longer than the 255-octet limit prescribed by RFC 1035. The parser enters a loop or performs exponential expansion, consuming significant CPU cycles.

The root cause is a missing validation step: after decompression, the routine does not check whether the resulting name length exceeds a safe threshold. In a typical implementation, this check is performed on the compressed size, not the expanded size. Because compression pointers can reference other pointers (recursive compression), the expansion is non-linear, and the CPU cost grows with each pointer dereference.

The attack vector is entirely network-based. An attacker does not require authentication or special privileges — only the ability to send a DNS query or a crafted DNS response to a target application. The attack surface includes any service that performs DNS resolution using the affected library: recursive resolvers, mail servers (MX lookups), web browsers, IoT devices, and enterprise applications that parse DNS packets.

The resource exhaustion is focused on a single thread. However, in multi-threaded applications (e.g., a DNS server handling hundreds of queries per second), a single malicious packet can tie up a worker thread indefinitely, causing degraded performance or complete service outage. In single-threaded event-loop architectures (e.g., Node.js dns module), the entire process becomes unresponsive.

Exploitation Scenarios

The following attack chain assumes a target application using the vulnerable resolv library to process DNS responses.

Step 1 — Reconnaissance and Target Identification:
Attacker identifies a target service that performs DNS lookups. This could be a public recursive resolver (e.g., a company's internal DNS server exposed to the internet), an email gateway that validates SPF/DKIM via DNS TXT records, or a web application with a customizable domain input (e.g., URL redirector). The attacker confirms DNS traffic is accepted from their IP address (e.g., by sending a benign ANY query and observing a response).

Step 2 — Crafting the Malicious DNS Packet:
The attacker constructs a DNS response packet (or query, depending on the vulnerable parsing path) with a malicious answer name field. The name field is built as follows:

• The first byte is a compression pointer (0xC0) to an offset within the packet.
• The referenced offset points to another compression pointer.
• This chain of pointers repeats 10-20 times.
• Each pointer dereference causes the parser to prepend data, and the chain ultimately references a label with a length byte of 63 (0x3F) followed by repeated 'A' characters.
• The decompression routine does not track the cumulative expanded length; it only checks the compressed pointer offset boundaries.

Result: The name expands to a string exceeding 10,000 characters, triggering excessive CPU loops in the decompression algorithm. The packet itself is small (under 100 bytes), easily fitting within the maximum DNS UDP payload (512 bytes) or TCP segment.

Step 3 — Delivery and Execution:
The attacker sends this crafted packet to the target's UDP port 53 (if it is a resolver) or triggers the target to send a query that gets a malicious response (e.g., a DNS cache poisoning attack or a MITM on a non-enrypted DNS connection). For a resolution-triggered attack (as opposed to direct packet injection), the attacker can:

• Register a domain and host a malicious authoritative DNS server that returns the crafted response.
• Trick the target into resolving that domain via a phishing email link or a web page that initiates a DNS lookup.

Step 4 — Post-Exploitation Impact:
Once the packet is parsed, the target thread consuming CPU becomes unresponsive. For a recursive DNS server, this blocks further queries, causing a service outage. For a web application, the DNS resolution thread hangs, delaying or blocking all subsequent outbound requests. Repeated injections (e.g., sending 100 packets) can exhaust multiple worker threads, resulting in full system DoS. An attacker can repeat this at will; no payload is required beyond the crafted packet.

Impact Assessment

Business Impact:

• Availability (CRITICAL): The vulnerability enables remote, unauthenticated DoS. Exploitation can cripple DNS infrastructure, making all dependent services inaccessible (email, web, internal name resolution). Even without full outage, application threads become unresponsive, causing latency spikes.
• Integrity / Confidentiality (NONE): No data exfiltration or modification is possible via this flaw; the sole impact is resource exhaustion.
• Attack Complexity (Low): The packet is simple to craft with standard DNS utilities (e.g., scapy, custom Python scripts). No special network position is required — standard internet connectivity suffices.

Affected Systems:

• Any application statically or dynamically linked against the vulnerable resolv library. Given the ambiguity of the vendor, the blast radius is wide: Linux distributions (glibc res_nquery), BSD libc (resolv), and third-party DNS parsing libraries (e.g., dnsmasq, unbound, PowerDNS) may be affected.
• IoT devices with hard-coded resolv implementations.
• Network appliances (firewalls, VPN concentrators) that perform DNS lookups for logging or policy enforcement.

Blast Radius: As per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the scope is Unchanged — only the vulnerable component is affected, not other security boundaries. The severity base score is High (7.5), driven by the network attack vector with no privileges or user interaction. The EPSS score is not yet scored by FIRST.org; exploitation in the wild is unknown, but the low complexity suggests active probing is likely once details become public.

Detection Guidance

The following detection rules assume network visibility and/or host-level instrumentation.

Sigma Rule

title: CVE-2025-24294 - Malicious DNS Packet with Excessive Name Decompression
id: 3d1a0c19-5b2e-4f77-9c21-8e518a58e410
status: experimental
description: Detects DNS responses containing compression pointer chains that exceed normal depth, indicating a potential DoS attack vector.
author: Valtersit Threat Intel
date: 2025/10/01
logsource:
  category: dns
  product: dns_query
detection:
  selection:
    query_length: 
      - '> 255'      # Expanded name length anomaly
    compression_chain_depth: '> 3'
  condition: selection
falsepositives:
  - Legitimate CDN or geo-routing TXT records that use multiple compression pointers (rare).
level: high

YARA Rule

rule CVE_2025_24294_Malicious_DNS_Compression {
    meta:
        author = "Valtersit Threat Intel"
        date = "2025-10-01"
        description = "Detects DNS packets with deep compression pointer chains indicating decompression bomb"
        severity = "high"
    strings:
        $ptr = { C0 [0-1] C0 [0-1] C0 [0-1] }  // Three consecutive 0xC0 pointers
        $label = { 3F 41 41 41 }               // Length 63 followed by repeated 'A'
    condition:
        uint8(0) == 0x00 and                  // DNS query header
        $ptr at 12 or $ptr in (12..4096) and   // Pointer chain anywhere in packet
        $label
}

Suricata IDS Rule

alert udp any any -> any 53 (msg:"CVE-2025-24294 Potential DNS Decompression DoS Attempt"; dsize:>60; content:"|c0|"; offset:12; depth:500; pcre:"/(?:c0.{2}){3,}/"; metadata:created_at 2025_10_01, updated_at 2025_10_01; sid:2025120501; rev:1;)

This rule flags UDP packets destined to port 53 that contain three or more consecutive compression pointer bytes (0xC0) within the first 500 bytes, indicating an abnormally deep decompression chain.

Elastic Detection

sequence by destination.ip with maxspan=1m
  [network where destination.port == 53 and event.category == "network" and
   wildcard(network.transport, "udp") and
   // Look for small packets with high compression ratio
   network.packets == 1 and network.bytes < 500]
  [process where event.type == "start" and process.name in ("named", "unbound", "dnsmasq") and
   process.args : "*parse*" or process.args : "*resolv*"]

This EQL rule correlates a burst of small DNS packets hitting the resolver followed by a spike in parser process activity, indicating potential CPU exhaustion.

Splunk SPL Query

index=dns sourcetype=dns_query
| eval packet_size = len(_raw)
| where packet_size < 500
| rex field=_raw "\\x{c0}(?<ptr>[\\x00-\\xff]{2})" max_match=50
| where mvcount(ptr) > 3
| stats count as malicious_packets by src_ip, dest_ip
| where malicious_packets > 5
| table _time, src_ip, dest_ip, malicious_packets

This SPL query extracts compression pointer bytes from raw packet captures, flags packets with more than 3 pointers, and groups by source/destination IP pairs.

Wazuh OSSEC Rule

<group name="dns_dos,">
  <rule id="100242" level="10">
    <decoded_as>dns</decoded_as>
    <field name="query_length">>255</field>
    <description>CVE-2025-24294: DNS packet with excessive decompression length detected</description>
    <group>attack,dos,</group>
    <mitre>
      <id>T1498</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single source claims a patch exists, but the vendor and fixed version are unconfirmed. Proceed with caution; do not assume a specific release resolves this issue without independent verification.

Immediate Mitigations (if unpatched):

1. Restrict Access: Limit DNS service exposure to trusted networks only; block inbound UDP/53 and TCP/53 from untrusted IP ranges unless the service is a public resolver.
2. Rate Limiting: Configure rate limiting on DNS servers to drop malformed packets or packets from a single source exceeding a threshold (e.g., 10 pps).
3. TCP Fallback: Force DNS-over-TCP for critical applications; some DoS vectors are less effective over TCP due to the connection state tracking.
4. Disable Recursion: If the vulnerable library is only used for forward lookups, disable recursion on the server to reduce the attack surface.

Patch/Upgrade Steps:

1. Wait for the vendor advisory (NVD entry will be updated). Monitor the CVE-2025-24294 NVD page for linked vendor URLs or patch details.
2. When a patch is confirmed, apply the update to the resolv library. For Linux, this may require updating glibc or rebuilding applications linking against libresolv. For third-party libraries (e.g., c-ares, ldns), upgrade to the patched version.
3. After patching, restart all dependent services to ensure the new library is loaded.

Long-Term Hardening:

1. Standardize DNS Libraries: Consolidate on a single, well-maintained resolver library across your estate to simplify patching.
2. Implement DNS Firewalling: Deploy a DNS firewall that inspects packet structure and blocks packets with malformed compression pointer chains.
3. Resource Controls: Use per-thread CPU limits (e.g., ulimit or container quotas) to contain thread-level DoS.
4. Fuzzing and CI: Integrate DNS packet fuzzing (e.g., using AFL with dnsmasq) into your build pipeline to catch such flaws before deployment.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24294
2. RFC 1035 (DNS wire format, compression pointers): https://www.rfc-editor.org/rfc/rfc1035
3. FIRST.org EPSS (status: not scored): https://www.first.org/epss/
4. CISA KEV Catalog (no listing currently): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. DNS resolver implementation references (glibc resolv, c-ares): https://www.gnu.org/software/libc/manual/html_node/Resolver.html

As of this writing, there are no known threat actor campaigns or exploit-in-the-wild evidence for CVE-2025-24294. The single patch source has not been cross-validated; treat the claim as unverified until a vendor advisory is published. The absence of an EPSS score and CISA KEV listing indicates limited current exploitation, but the low attack complexity warrants priority patching once a fix is confirmed.