CVE-2026-80212

Deferred Deferred - Pending Action

Memory Leak in Ruby Resolv DNS Resource Handling

Publication date: 2026-08-27

Last updated on: 2026-09-09

Assigner: MITRE

Description

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80212

EUVD

EUVD-2026-67138

Affected Vendors & Products

Vendor	Product	Version / Range
ruby	resolv	0.7.2
ruby	resolv	0.4.0
ruby	resolv	0.5.0
ruby	resolv	0.6.0
ruby	resolv	0.7.1
ruby	resolv	0.3.1
ruby	resolv	From 0.3.1 (inc) to 0.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-80212 is a memory exhaustion vulnerability in Ruby's resolv gem. Attackers can send malicious DNS responses with many unique record types, causing the library to permanently store each type in memory. This leads to unbounded memory growth until the application crashes.

Detection Guidance

Monitor Ruby applications using the resolv gem for unusual memory growth during DNS resolution. Check for processes consuming excessive memory after handling DNS responses. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory usage trends in Ruby processes.

Impact Analysis

This vulnerability can cause applications using the resolv gem to crash due to excessive memory consumption. It may lead to denial-of-service conditions, disrupting services that rely on DNS resolution. Systems processing untrusted DNS responses are most at risk.

Compliance Impact

This vulnerability primarily causes memory exhaustion in applications using the resolv gem, leading to crashes. It does not directly impact data confidentiality, integrity, or access control required by standards like GDPR or HIPAA. However, service disruptions from crashes could indirectly affect compliance by causing downtime or data processing delays.

Mitigation Strategies

Update the resolv gem to version 0.7.2 or later. For Ruby 3.3 users, update to version 0.3.2. If using Ruby 3.2, install resolv 0.7.2 as the series is end-of-life. Verify gem versions with 'gem list resolv' and update via 'gem install resolv -v 0.7.2'.

Hi! I’m here to help you understand CVE-2026-80212. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70