CVE-2026-80212

The resolv gem before 0.7.2 (a default gem bundled with Ruby) has an unbounded memory-growth flaw: each time DNS decoding encounters an unknown resource-record (type, class) pair or an unknown SvcParamKey, Resolv::DNS::Resource.get_class and the related Generic.create methods generate a new class and permanently register it as a constant and in the ClassHash lookup table, so the garbage collector can never reclaim it (CWE-770). An attacker who can influence the DNS responses an application decodes — via a spoofed response or a malicious or hijacked upstream DNS server — can send tens of thousands of distinct unknown types, and a single response of a few hundred kilobytes can grow process memory by tens of megabytes. Repeated responses accumulate without bound, eventually exhausting process or host memory and causing denial of service; confidentiality and integrity are unaffected. Any Ruby code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected, and because resolv is a default gem this is reachable from a plain Ruby installation with no additional dependencies. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; EPSS estimates a 0.6% probability of exploitation within 30 days.

What to do: Upgrade the resolv gem to 0.7.2 or later (install/require resolv >= 0.7.2 and ensure the default gem bundled with your Ruby release is updated). Audit applications and dependencies for code paths that call Resolv::DNS::Message.decode on untrusted DNS responses; until patched, restrict decoding to responses from trusted resolvers, limit DNS response sizes, and consider periodically restarting long-running processes that perform such decoding. Monitor the Ruby security team for bundled-gem updates covering your Ruby version.