CVE-2026-80212 Denial of service in resolv
An attacker can cause memory exhaustion and denial of service in Ruby applications by sending crafted DNS responses that trigger unbounded class generation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80212?
CVE-2026-80212 is a high-severity denial of service vulnerability in Ruby resolv, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.
Weakness: CWE-770
Which versions are affected by CVE-2026-80212?
Linux distribution packages (40)
ruby AlmaLinux:10 | All versions | 3.3.12-15.el10_2 |
ruby-bundled-gems AlmaLinux:10 | All versions | 3.3.12-15.el10_2 |
ruby-default-gems AlmaLinux:10 | All versions | 3.3.12-15.el10_2 |
ruby-devel AlmaLinux:10 | All versions | 3.3.12-15.el10_2 |
ruby-doc AlmaLinux:10 | All versions | 3.3.12-15.el10_2 |
ruby-libs AlmaLinux:10 | All versions | 3.3.12-15.el10_2 |
ruby4.0 AlmaLinux:10 | All versions | 4.0.6-37.el10_2 |
ruby4.0-devel AlmaLinux:10 | All versions | 4.0.6-37.el10_2 |
ruby4.0-doc AlmaLinux:10 | All versions | 4.0.6-37.el10_2 |
ruby4.0-rubygem-mysql2 AlmaLinux:10 | All versions | 0.5.7-37.el10_2 |
ruby4.0-rubygem-pg AlmaLinux:10 | All versions | 1.6.3-37.el10_2 |
rubygem-bigdecimal AlmaLinux:10 | All versions | 3.1.5-15.el10_2 |
rubygem-bundler AlmaLinux:10 | All versions | 2.5.22-15.el10_2 |
rubygem-io-console AlmaLinux:10 | All versions | 0.7.1-15.el10_2 |
rubygem-irb AlmaLinux:10 | All versions | 1.13.1-15.el10_2 |
rubygem-json AlmaLinux:10 | All versions | 2.7.2-15.el10_2 |
rubygem-minitest AlmaLinux:10 | All versions | 5.20.0-15.el10_2 |
rubygem-power_assert AlmaLinux:10 | All versions | 2.0.3-15.el10_2 |
rubygem-psych AlmaLinux:10 | All versions | 5.1.2-15.el10_2 |
rubygem-racc AlmaLinux:10 | All versions | 1.7.3-15.el10_2 |
rubygem-rake AlmaLinux:10 | All versions | 13.1.0-15.el10_2 |
rubygem-rbs AlmaLinux:10 | All versions | 3.4.0-15.el10_2 |
rubygem-rdoc AlmaLinux:10 | All versions | 6.6.3.1-15.el10_2 |
rubygem-rexml AlmaLinux:10 | All versions | 3.4.4-15.el10_2 |
rubygem-rss AlmaLinux:10 | All versions | 0.3.1-15.el10_2 |
rubygem-test-unit AlmaLinux:10 | All versions | 3.6.1-15.el10_2 |
rubygem-typeprof AlmaLinux:10 | All versions | 0.21.9-15.el10_2 |
rubygems AlmaLinux:10 | All versions | 3.5.22-15.el10_2 |
rubygems-devel AlmaLinux:10 | All versions | 3.5.22-15.el10_2 |
ruby AlmaLinux:8 | All versions | 3.3.12-9.module_el8.10.0+4288+ce06a94b |
ruby-bundled-gems AlmaLinux:8 | All versions | 3.3.12-9.module_el8.10.0+4288+ce06a94b |
ruby-default-gems AlmaLinux:8 | All versions | 3.3.12-9.module_el8.10.0+4288+ce06a94b |
ruby-devel AlmaLinux:8 | All versions | 3.3.12-9.module_el8.10.0+4288+ce06a94b |
ruby-doc AlmaLinux:8 | All versions | 3.3.12-9.module_el8.10.0+4288+ce06a94b |
ruby-libs AlmaLinux:8 | All versions | 3.3.12-9.module_el8.10.0+4288+ce06a94b |
rubygem-abrt AlmaLinux:8 | All versions | 0.4.0-1.module_el8.10.0+3799+191214cc |
rubygem-abrt-doc AlmaLinux:8 | All versions | 0.4.0-1.module_el8.10.0+3799+191214cc |
rubygem-bigdecimal AlmaLinux:8 | All versions | 3.1.5-9.module_el8.10.0+4288+ce06a94b |
rubygem-bundler AlmaLinux:8 | All versions | 2.5.22-9.module_el8.10.0+4288+ce06a94b |
rubygem-io-console AlmaLinux:8 | All versions | 0.7.1-9.module_el8.10.0+4288+ce06a94b |
How do I fix CVE-2026-80212?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-80212 being exploited?
There is no known exploitation of CVE-2026-80212 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-80212, ALSA-2026:72285, ALSA-2026:72286, ALSA-2026:72427, ALSA-2026:72484, ALSA-2026:72485 and 24 more.