Skip to content
Fencer Vulns
high 7.5

CVE-2026-80212 json

An issue was discovered in the resolv gem before 0.7.2 for Ruby.

published 2026-08-27 2 mo ago modified 2026-09-09 2 mo ago also EUVD-2026-67138

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.

Patch / fix

  • Ruby resolv 0.3.2, 0.7.2
  • ruby3.3 Debian 13 3.3.13-0+deb13u1

debian advisories DEBIAN-CVE-2026-80212

  • ruby RHEL 10.2 3.3.12-15.el10_2
  • rubygems RHEL 10.2 3.5.22-15.el10_2
  • ruby-libs RHEL 10.2 3.3.12-15.el10_2
  • rubygem-irb RHEL 10.2 1.13.1-15.el10_2
  • rubygem-rbs RHEL 10.2 3.4.0-15.el10_2
  • rubygem-rss RHEL 10.2 0.3.1-15.el10_2
  • rubygem-json RHEL 10.2 2.7.2-15.el10_2
  • rubygem-racc RHEL 10.2 1.7.3-15.el10_2

red hat advisories RHSA-2026:83574RHSA-2026:83571RHSA-2026:83572RHSA-2026:83570RHSA-2026:72785RHSA-2026:73519

  • ruby AlmaLinux 8 2.5.9-116.module_el8.10.0+4294+1072b022
  • ruby-irb AlmaLinux 8 2.5.9-116.module_el8.10.0+4293+d4d7c902
  • rubygems AlmaLinux 8 2.7.6.3-116.module_el8.10.0+4294+1072b022
  • ruby-libs AlmaLinux 8 2.5.9-116.module_el8.10.0+4293+d4d7c902
  • ruby-libs AlmaLinux 8 2.5.9-116.module_el8.10.0+4294+1072b022
  • rubygem-pg AlmaLinux 8 1.0.0-3.module_el8.9.0+3635+c6f99506
  • rubygem-abrt AlmaLinux 8 0.3.0-4.module_el8.5.0+2625+ec418553
  • rubygem-bson AlmaLinux 8 4.3.0-2.module_el8.5.0+2625+ec418553

almalinux advisories ALSA-2026:73519ALSA-2026:72285ALSA-2026:72286ALSA-2026:72427ALSA-2026:72484ALSA-2026:72485

  • ruby Rocky Linux 10 3.3.12-15.el10_2
  • rubygem-pg Rocky Linux 8 1.0.0-3.module+el8.9.0+1536+5f79634e
  • rubygem-abrt Rocky Linux 8 0.3.0-4.module+el8.5.0+738+032c9c02
  • rubygem-abrt Rocky Linux 8 0.3.0-4.module+el8.9.0+1536+5f79634e
  • rubygem-bson Rocky Linux 8 4.3.0-2.module+el8.9.0+1536+5f79634e
  • rubygem-mysql2 Rocky Linux 8 0.4.10-4.module+el8.9.0+1536+5f79634e
  • rubygem-bundler Rocky Linux 8 1.16.1-5.module+el8.10.0+1979+815637df
  • ruby4.0 Rocky Linux 10 4.0.6-37.el10_2

rocky linux advisories RLSA-2026:72785RLSA-2026:73519RLSA-2026:72427RLSA-2026:72286RLSA-2026:72484RLSA-2026:72485

  • ruby Alpine 3.21 3.3.13-r0
  • ruby Alpine 3.24, Alpine 3.23, Alpine 3.22 3.4.12-r0

alpine advisories ALPINE-CVE-2026-80212

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ruby Azure Linux 3.0 3.3.5-9

azure linux advisories AZL-98232

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-80212 updated cvss 7.5

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

  • Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 6 ruby, ruby-ri, ruby-irb, ruby-libs, ruby-rdoc, ruby-tcltk
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) ruby-doc 3.0.7-166.el9_6
    fixed: vendor fix RHSA-2026:83571
  • Red Hat Enterprise Linux AppStream (v. 8) ruby 3.3.12-9.module+el8.10.0+24850+a62b5b25, ruby 2.5.9-116.module+el8.10.0+24853+52b5af56, rubygem-pg 1.0.0-3.module+el8.9.0+19193+435404ae, rubygems 3.5.22-9.module+el8.10.0+24850+a62b5b25, ruby-irb 2.5.9-116.module+el8.10.0+24853+52b5af56, ruby-libs 3.3.12-9.module+el8.10.0+24850+a62b5b25, +41 more
    fixed: vendor fix RHSA-2026:73519
  • Red Hat Enterprise Linux AppStream (v. 9) ruby 3.0.7-168.el9_8, ruby-libs 3.0.7-168.el9_8, rubygems 3.2.33-168.el9_8, rubygem-irb 1.3.5-168.el9_8, rubygem-rbs 1.4.0-168.el9_8, rubygem-rss 0.2.9-168.el9_8, +59 more
    fixed: vendor fix RHSA-2026:72286
  • Red Hat Enterprise Linux AppStream (v. 10) ruby 3.3.12-15.el10_2, ruby4.0 4.0.6-37.el10_2, rubygems 3.5.22-15.el10_2, ruby-libs 3.3.12-15.el10_2, rubygem-rbs 3.4.0-15.el10_2, rubygem-rss 0.3.1-15.el10_2, +18 more
    fixed: vendor fix RHSA-2026:72785
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) ruby 2.5.9-110.module+el8.4.0+25044+d8ea83a3, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, ruby-irb 2.5.9-110.module+el8.4.0+25044+d8ea83a3, ruby-libs 2.5.9-110.module+el8.4.0+25044+d8ea83a3, rubygem-abrt 0.3.0-4.module+el8.1.0+3656+f80bfa1d, rubygem-bson 4.3.0-2.module+el8.1.0+3656+f80bfa1d, +17 more
    fixed: vendor fix RHSA-2026:95512
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) ruby 2.5.9-113.module+el8.6.0+25038+e1ee8198, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, ruby-irb 2.5.9-113.module+el8.6.0+25038+e1ee8198, ruby-libs 2.5.9-113.module+el8.6.0+25038+e1ee8198, rubygem-abrt 0.3.0-4.module+el8.1.0+3656+f80bfa1d, rubygem-bson 4.3.0-2.module+el8.1.0+3656+f80bfa1d, +17 more
    fixed: vendor fix RHSA-2026:95513
show 15 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) ruby 2.5.9-113.module+el8.8.0+25037+4937972b, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, ruby-irb 2.5.9-113.module+el8.8.0+25037+4937972b, ruby-libs 2.5.9-113.module+el8.8.0+25037+4937972b, rubygem-abrt 0.3.0-4.module+el8.1.0+3656+f80bfa1d, rubygem-bson 4.3.0-2.module+el8.1.0+3656+f80bfa1d, +17 more
    fixed: vendor fix RHSA-2026:95514
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) ruby 3.0.4-162.el9_2, ruby-libs 3.0.4-162.el9_2, rubygems 3.2.33-162.el9_2, rubygem-irb 1.3.5-162.el9_2, rubygem-rbs 1.4.0-162.el9_2, rubygem-rss 0.2.9-162.el9_2, +13 more
    fixed: vendor fix RHSA-2026:83574
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) ruby 3.0.7-163.el9_4, ruby-libs 3.0.7-163.el9_4, rubygems 3.2.33-163.el9_4, rubygem-irb 1.3.5-163.el9_4, rubygem-rbs 1.4.0-163.el9_4, rubygem-rss 0.2.9-163.el9_4, +36 more
    fixed: vendor fix RHSA-2026:83572
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ruby 3.3.12-12.el10_0, rubygems 3.5.22-12.el10_0, ruby-libs 3.3.12-12.el10_0, rubygem-rbs 3.4.0-12.el10_0, rubygem-rss 0.3.1-12.el10_0, rubygem-irb 1.13.1-12.el10_0, +15 more
    fixed: vendor fix RHSA-2026:83570
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) ruby 3.0.7-166.el9_6, ruby-libs 3.0.7-166.el9_6, rubygems 3.2.33-166.el9_6, rubygem-irb 1.3.5-166.el9_6, rubygem-rbs 1.4.0-166.el9_6, rubygem-rss 0.2.9-166.el9_6, +36 more
    fixed: vendor fix RHSA-2026:83571
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) ruby 2.5.9-110.module+el8.4.0+25044+d8ea83a3, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, ruby-irb 2.5.9-110.module+el8.4.0+25044+d8ea83a3, ruby-libs 2.5.9-110.module+el8.4.0+25044+d8ea83a3, rubygem-abrt 0.3.0-4.module+el8.1.0+3656+f80bfa1d, rubygem-bson 4.3.0-2.module+el8.1.0+3656+f80bfa1d, +17 more
    fixed: vendor fix RHSA-2026:95512
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) ruby 2.5.9-113.module+el8.6.0+25038+e1ee8198, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, ruby-irb 2.5.9-113.module+el8.6.0+25038+e1ee8198, ruby-libs 2.5.9-113.module+el8.6.0+25038+e1ee8198, rubygem-abrt 0.3.0-4.module+el8.1.0+3656+f80bfa1d, rubygem-bson 4.3.0-2.module+el8.1.0+3656+f80bfa1d, +17 more
    fixed: vendor fix RHSA-2026:95513
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) ruby 2.5.9-113.module+el8.8.0+25037+4937972b, rubygem-pg 1.0.0-2.module+el8.1.0+3656+f80bfa1d, ruby-irb 2.5.9-113.module+el8.8.0+25037+4937972b, ruby-libs 2.5.9-113.module+el8.8.0+25037+4937972b, rubygem-abrt 0.3.0-4.module+el8.1.0+3656+f80bfa1d, rubygem-bson 4.3.0-2.module+el8.1.0+3656+f80bfa1d, +17 more
    fixed: vendor fix RHSA-2026:95514
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ruby-doc 3.0.7-168.el9_8
    fixed: vendor fix RHSA-2026:72286
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc 3.3.12-15.el10_2, ruby4.0-doc 4.0.6-37.el10_2
    fixed: vendor fix RHSA-2026:72785
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) ruby-doc 3.3.12-12.el10_0
    fixed: vendor fix RHSA-2026:83570
  • Red Hat Enterprise Linux Server (v. 7 ELS) ruby 2.0.0.648-40.el7_9, rubygems 2.0.14.1-40.el7_9, ruby-irb 2.0.0.648-40.el7_9, rubygem-json 1.7.7-40.el7_9, rubygem-rdoc 4.0.0-40.el7_9, ruby-libs 2.0.0.648-40.el7_9, +3 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) rubygem-rake 0.9.6-40.el7_9, ruby-tcltk 2.0.0.648-40.el7_9, rubygem-minitest 4.3.2-40.el7_9
    fixed: vendor fix RHSA-2026:96099
  • Red Hat Hardened Images ruby4.0 4.0.6-37.2.hum1, ruby4.0 4.0.6-37.3.hum1, ruby3.3 3.3.10-23.5.hum1, ruby3.3 3.3.10-23.6.hum1, ruby3.4 3.4.10-31.6.hum1, ruby4.0-libs 4.0.6-37.2.hum1, +48 more
    fixed: vendor fix RHSA-2026:57986
  • Red Hat 3scale API Management Platform 2 3scale-amp2/backend-rhel8, 3scale-amp2/toolbox-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Hardened Images rubygem3.3-rbs 3.4.0-23.5.hum1, rubygem3.3-rss 0.3.1-23.5.hum1, rubygem3.4-rbs 3.8.0-31.6.hum1, rubygem3.4-rss 0.3.1-31.6.hum1, rubygem4.0-rss 0.3.2-37.2.hum1, rubygem3.3-irb 1.13.1-23.5.hum1, +45 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Ruby resolv

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.