CVE-2026-80212: High severity rubygems/resolv vulnerability
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
resolvto a version that resolves this vulnerability.Fixed in 0.7.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Ruby applications using resolv versions before 0.7.2 are affected if they decode attacker-influenced DNS responses through Resolv::DNS::Message.decode. This includes applications whose DNS responses can be spoofed or are supplied by a malicious or hijacked upstream DNS server.
What does an attacker need to exploit this issue?
An attacker needs control over DNS responses that reach an affected decoding path. They can include many distinct unknown DNS resource-record type/class pairs or unknown SvcParamKey values in responses to cause permanent memory growth.
What is the operational impact of repeated malicious responses?
Each unknown value can create a class that remains permanently reachable through registered constants and lookup hashes, so garbage collection does not reclaim it. Repeated responses can accumulate memory without bound and lead to denial of service.
What version should be deployed to address the affected version range?
Update resolv to version 0.7.2 or later. The issue affects versions before 0.7.2.