CVE-2026-80212: ruby resolv

Deferred

AliasesRHSA-2026:72285RHSA-2026:72286RHSA-2026:72427+16 more

Published 27-08-2026Last modified 27-08-2026

Vulnerability summary

CVE-2026-80212 is a high (CVSS 7.5) vulnerability in ruby resolv. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34.4% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.40%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6

RHSA-2026:57565 RHSA-2026:57986 RHSA-2026:57994 RHSA-2026:62562 RHSA-2026:62563 RHSA-2026:73519

Timeline

27-08-2026
PublishedVulnerability first disclosed.
27-08-2026
Last modifiedVulnerability information updated.

Description

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.5

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

34%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.40% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat53 products

ruby< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6 | < 0:3.0.7-163.el9_4 | < 0:3.0.4-162.el9_2
ruby-bundled-gems< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0
ruby-bundled-gems-debuginfo< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0
ruby-debuginfo< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6 | < 0:3.0.7-163.el9_4 | < 0:3.0.4-162.el9_2
ruby-debugsource< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6 | < 0:3.0.7-163.el9_4 | < 0:3.0.4-162.el9_2

ruby-default-gems< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6 | < 0:3.0.7-163.el9_4 | < 0:3.0.4-162.el9_2
ruby-devel< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6 | < 0:3.0.7-163.el9_4 | < 0:3.0.4-162.el9_2
ruby-doc< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6
ruby-libs< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6 | < 0:3.0.7-163.el9_4 | < 0:3.0.4-162.el9_2
ruby-libs-debuginfo< 0:3.3.12-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.7-168.el9_8 | < 0:4.0.6-35.module+el9.8.0+24852+4534d062 | < 0:3.3.12-9.module+el9.8.0+24851+57cc0ffc | < 0:3.3.12-15.el10_2 | < 0:3.3.12-12.el10_0 | < 0:3.0.7-166.el9_6 | < 0:3.0.7-163.el9_4 | < 0:3.0.4-162.el9_2
ruby4.0< 0:4.0.6-37.el10_2
ruby4.0-debuginfo< 0:4.0.6-37.el10_2
ruby4.0-debugsource< 0:4.0.6-37.el10_2
ruby4.0-devel< 0:4.0.6-37.el10_2
ruby4.0-doc< 0:4.0.6-37.el10_2
ruby4.0-rubygem-mysql2< 0:0.5.7-37.el10_2
ruby4.0-rubygem-mysql2-debuginfo< 0:0.5.7-37.el10_2
ruby4.0-rubygem-pg< 0:1.6.3-37.el10_2
ruby4.0-rubygem-pg-debuginfo< 0:1.6.3-37.el10_2
rubygem-abrt< 0:0.4.0-1.module+el8.10.0+21226+b78a28c4
rubygem-abrt-doc< 0:0.4.0-1.module+el8.10.0+21226+b78a28c4
rubygem-bigdecimal< 0:3.1.5-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.0-168.el9_8 | < 0:4.0.1-35.module+el9.8.0+24852+4534d062 | < 0:3.1.5-9.module+el9.8.0+24851+57cc0ffc | < 0:3.1.5-15.el10_2 | < 0:3.1.5-12.el10_0 | < 0:3.0.0-166.el9_6 | < 0:3.0.0-163.el9_4 | < 0:3.0.0-162.el9_2
rubygem-bigdecimal-debuginfo< 0:3.1.5-9.module+el8.10.0+24850+a62b5b25 | < 0:3.0.0-168.el9_8 | < 0:4.0.1-35.module+el9.8.0+24852+4534d062 | < 0:3.1.5-9.module+el9.8.0+24851+57cc0ffc | < 0:3.1.5-15.el10_2 | < 0:3.1.5-12.el10_0 | < 0:3.0.0-166.el9_6 | < 0:3.0.0-163.el9_4 | < 0:3.0.0-162.el9_2
rubygem-bundler< 0:2.5.22-9.module+el8.10.0+24850+a62b5b25 | < 0:2.2.33-168.el9_8 | < 0:4.0.16-35.module+el9.8.0+24852+4534d062 | < 0:2.5.22-9.module+el9.8.0+24851+57cc0ffc | < 0:2.5.22-15.el10_2 | < 0:2.5.22-12.el10_0 | < 0:2.2.33-166.el9_6 | < 0:2.2.33-163.el9_4 | < 0:2.2.33-162.el9_2
rubygem-io-console< 0:0.7.1-9.module+el8.10.0+24850+a62b5b25 | < 0:0.5.7-168.el9_8 | < 0:0.8.2-35.module+el9.8.0+24852+4534d062 | < 0:0.7.1-9.module+el9.8.0+24851+57cc0ffc | < 0:0.7.1-15.el10_2 | < 0:0.7.1-12.el10_0 | < 0:0.5.7-166.el9_6 | < 0:0.5.7-163.el9_4 | < 0:0.5.7-162.el9_2
rubygem-io-console-debuginfo< 0:0.7.1-9.module+el8.10.0+24850+a62b5b25 | < 0:0.5.7-168.el9_8 | < 0:0.8.2-35.module+el9.8.0+24852+4534d062 | < 0:0.7.1-9.module+el9.8.0+24851+57cc0ffc | < 0:0.7.1-15.el10_2 | < 0:0.7.1-12.el10_0 | < 0:0.5.7-166.el9_6 | < 0:0.5.7-163.el9_4 | < 0:0.5.7-162.el9_2
rubygem-irb< 0:1.13.1-9.module+el8.10.0+24850+a62b5b25 | < 0:1.3.5-168.el9_8 | < 0:1.16.0-35.module+el9.8.0+24852+4534d062 | < 0:1.13.1-9.module+el9.8.0+24851+57cc0ffc | < 0:1.13.1-15.el10_2 | < 0:1.13.1-12.el10_0 | < 0:1.3.5-166.el9_6 | < 0:1.3.5-163.el9_4 | < 0:1.3.5-162.el9_2
rubygem-json< 0:2.7.2-9.module+el8.10.0+24850+a62b5b25 | < 0:2.5.1-168.el9_8 | < 0:2.18.0-35.module+el9.8.0+24852+4534d062 | < 0:2.7.2-9.module+el9.8.0+24851+57cc0ffc | < 0:2.7.2-15.el10_2 | < 0:2.7.2-12.el10_0 | < 0:2.5.1-166.el9_6 | < 0:2.5.1-163.el9_4 | < 0:2.5.1-162.el9_2
rubygem-json-debuginfo< 0:2.7.2-9.module+el8.10.0+24850+a62b5b25 | < 0:2.5.1-168.el9_8 | < 0:2.18.0-35.module+el9.8.0+24852+4534d062 | < 0:2.7.2-9.module+el9.8.0+24851+57cc0ffc | < 0:2.7.2-15.el10_2 | < 0:2.7.2-12.el10_0 | < 0:2.5.1-166.el9_6 | < 0:2.5.1-163.el9_4 | < 0:2.5.1-162.el9_2
rubygem-minitest< 0:5.20.0-9.module+el8.10.0+24850+a62b5b25 | < 0:5.14.2-168.el9_8 | < 0:6.0.0-35.module+el9.8.0+24852+4534d062 | < 0:5.20.0-9.module+el9.8.0+24851+57cc0ffc | < 0:5.20.0-15.el10_2 | < 0:5.20.0-12.el10_0 | < 0:5.14.2-166.el9_6 | < 0:5.14.2-163.el9_4 | < 0:5.14.2-162.el9_2
rubygem-mysql2< 0:0.5.5-1.module+el8.10.0+21226+b78a28c4 | < 0:0.5.7-1.module+el9.8.0+24428+77f1d00a | < 0:0.5.5-3.module+el9.8.0+24356+77305e91
rubygem-mysql2-debuginfo< 0:0.5.5-1.module+el8.10.0+21226+b78a28c4 | < 0:0.5.7-1.module+el9.8.0+24428+77f1d00a | < 0:0.5.5-3.module+el9.8.0+24356+77305e91
rubygem-mysql2-debugsource< 0:0.5.5-1.module+el8.10.0+21226+b78a28c4 | < 0:0.5.7-1.module+el9.8.0+24428+77f1d00a | < 0:0.5.5-3.module+el9.8.0+24356+77305e91
rubygem-mysql2-doc< 0:0.5.5-1.module+el8.10.0+21226+b78a28c4 | < 0:0.5.7-1.module+el9.8.0+24428+77f1d00a | < 0:0.5.5-3.module+el9.8.0+24356+77305e91
rubygem-pg< 0:1.5.4-1.module+el8.10.0+21226+b78a28c4 | < 0:1.6.3-1.module+el9.8.0+24428+77f1d00a | < 0:1.5.4-2.module+el9.8.0+24356+77305e91
rubygem-pg-debuginfo< 0:1.5.4-1.module+el8.10.0+21226+b78a28c4 | < 0:1.6.3-1.module+el9.8.0+24428+77f1d00a | < 0:1.5.4-2.module+el9.8.0+24356+77305e91
rubygem-pg-debugsource< 0:1.5.4-1.module+el8.10.0+21226+b78a28c4 | < 0:1.6.3-1.module+el9.8.0+24428+77f1d00a | < 0:1.5.4-2.module+el9.8.0+24356+77305e91
rubygem-pg-doc< 0:1.5.4-1.module+el8.10.0+21226+b78a28c4 | < 0:1.6.3-1.module+el9.8.0+24428+77f1d00a | < 0:1.5.4-2.module+el9.8.0+24356+77305e91
rubygem-power_assert< 0:2.0.3-9.module+el8.10.0+24850+a62b5b25 | < 0:1.2.1-168.el9_8 | < 0:3.0.1-35.module+el9.8.0+24852+4534d062 | < 0:2.0.3-9.module+el9.8.0+24851+57cc0ffc | < 0:2.0.3-15.el10_2 | < 0:2.0.3-12.el10_0 | < 0:1.2.1-166.el9_6 | < 0:1.2.1-163.el9_4 | < 0:1.2.0-162.el9_2
rubygem-psych< 0:5.1.2-9.module+el8.10.0+24850+a62b5b25 | < 0:3.3.2-168.el9_8 | < 0:5.3.1-35.module+el9.8.0+24852+4534d062 | < 0:5.1.2-9.module+el9.8.0+24851+57cc0ffc | < 0:5.1.2-15.el10_2 | < 0:5.1.2-12.el10_0 | < 0:3.3.2-166.el9_6 | < 0:3.3.2-163.el9_4 | < 0:3.3.2-162.el9_2
rubygem-psych-debuginfo< 0:5.1.2-9.module+el8.10.0+24850+a62b5b25 | < 0:3.3.2-168.el9_8 | < 0:5.3.1-35.module+el9.8.0+24852+4534d062 | < 0:5.1.2-9.module+el9.8.0+24851+57cc0ffc | < 0:5.1.2-15.el10_2 | < 0:5.1.2-12.el10_0 | < 0:3.3.2-166.el9_6 | < 0:3.3.2-163.el9_4 | < 0:3.3.2-162.el9_2
rubygem-racc< 0:1.7.3-9.module+el8.10.0+24850+a62b5b25 | < 0:1.8.1-35.module+el9.8.0+24852+4534d062 | < 0:1.7.3-9.module+el9.8.0+24851+57cc0ffc | < 0:1.7.3-15.el10_2 | < 0:1.7.3-12.el10_0
rubygem-racc-debuginfo< 0:1.7.3-9.module+el8.10.0+24850+a62b5b25 | < 0:1.8.1-35.module+el9.8.0+24852+4534d062 | < 0:1.7.3-9.module+el9.8.0+24851+57cc0ffc | < 0:1.7.3-15.el10_2 | < 0:1.7.3-12.el10_0
rubygem-rake< 0:13.1.0-9.module+el8.10.0+24850+a62b5b25 | < 0:13.0.3-168.el9_8 | < 0:13.3.1-35.module+el9.8.0+24852+4534d062 | < 0:13.1.0-9.module+el9.8.0+24851+57cc0ffc | < 0:13.1.0-15.el10_2 | < 0:13.1.0-12.el10_0 | < 0:13.0.3-166.el9_6 | < 0:13.0.3-163.el9_4 | < 0:13.0.3-162.el9_2
rubygem-rbs< 0:3.4.0-9.module+el8.10.0+24850+a62b5b25 | < 0:1.4.0-168.el9_8 | < 0:3.10.0-35.module+el9.8.0+24852+4534d062 | < 0:3.4.0-9.module+el9.8.0+24851+57cc0ffc | < 0:3.4.0-15.el10_2 | < 0:3.4.0-12.el10_0 | < 0:1.4.0-166.el9_6 | < 0:1.4.0-163.el9_4 | < 0:1.4.0-162.el9_2
rubygem-rbs-debuginfo< 0:3.4.0-9.module+el8.10.0+24850+a62b5b25 | < 0:3.10.0-35.module+el9.8.0+24852+4534d062 | < 0:3.4.0-9.module+el9.8.0+24851+57cc0ffc | < 0:3.4.0-15.el10_2 | < 0:3.4.0-12.el10_0
rubygem-rdoc< 0:6.6.3.1-9.module+el8.10.0+24850+a62b5b25 | < 0:6.3.4.1-168.el9_8 | < 0:7.0.4-35.module+el9.8.0+24852+4534d062 | < 0:6.6.3.1-9.module+el9.8.0+24851+57cc0ffc | < 0:6.6.3.1-15.el10_2 | < 0:6.6.3.1-12.el10_0 | < 0:6.3.4.1-166.el9_6 | < 0:6.3.4.1-163.el9_4 | < 0:6.3.3-162.el9_2
rubygem-rexml< 0:3.4.4-9.module+el8.10.0+24850+a62b5b25 | < 0:3.2.5-168.el9_8 | < 0:3.4.4-35.module+el9.8.0+24852+4534d062 | < 0:3.4.4-9.module+el9.8.0+24851+57cc0ffc | < 0:3.4.4-15.el10_2 | < 0:3.4.4-12.el10_0 | < 0:3.2.5-166.el9_6 | < 0:3.2.5-163.el9_4 | < 0:3.2.5-162.el9_2
rubygem-rss< 0:0.3.1-9.module+el8.10.0+24850+a62b5b25 | < 0:0.2.9-168.el9_8 | < 0:0.3.2-35.module+el9.8.0+24852+4534d062 | < 0:0.3.1-9.module+el9.8.0+24851+57cc0ffc | < 0:0.3.1-15.el10_2 | < 0:0.3.1-12.el10_0 | < 0:0.2.9-166.el9_6 | < 0:0.2.9-163.el9_4 | < 0:0.2.9-162.el9_2
rubygem-test-unit< 0:3.6.1-9.module+el8.10.0+24850+a62b5b25 | < 0:3.3.7-168.el9_8 | < 0:3.7.5-35.module+el9.8.0+24852+4534d062 | < 0:3.6.1-9.module+el9.8.0+24851+57cc0ffc | < 0:3.6.1-15.el10_2 | < 0:3.6.1-12.el10_0 | < 0:3.3.7-166.el9_6 | < 0:3.3.7-163.el9_4 | < 0:3.3.7-162.el9_2
rubygem-typeprof< 0:0.21.9-9.module+el8.10.0+24850+a62b5b25 | < 0:0.15.2-168.el9_8 | < 0:0.31.1-35.module+el9.8.0+24852+4534d062 | < 0:0.21.9-9.module+el9.8.0+24851+57cc0ffc | < 0:0.21.9-15.el10_2 | < 0:0.21.9-12.el10_0 | < 0:0.15.2-166.el9_6 | < 0:0.15.2-163.el9_4 | < 0:0.15.2-162.el9_2
rubygems< 0:3.5.22-9.module+el8.10.0+24850+a62b5b25 | < 0:3.2.33-168.el9_8 | < 0:4.0.16-35.module+el9.8.0+24852+4534d062 | < 0:3.5.22-9.module+el9.8.0+24851+57cc0ffc | < 0:3.5.22-15.el10_2 | < 0:3.5.22-12.el10_0 | < 0:3.2.33-166.el9_6 | < 0:3.2.33-163.el9_4 | < 0:3.2.33-162.el9_2
rubygems-devel< 0:3.5.22-9.module+el8.10.0+24850+a62b5b25 | < 0:3.2.33-168.el9_8 | < 0:4.0.16-35.module+el9.8.0+24852+4534d062 | < 0:3.5.22-9.module+el9.8.0+24851+57cc0ffc | < 0:3.5.22-15.el10_2 | < 0:3.5.22-12.el10_0 | < 0:3.2.33-166.el9_6 | < 0:3.2.33-163.el9_4 | < 0:3.2.33-162.el9_2

Show all 53

Chainguard4 products

ruby-3.2All versions (No fix recorded)
ruby-3.3< 3.3.12-r5
ruby-3.4All versions (No fix recorded) | < 3.4.10-r7
ruby-4.0All versions (No fix recorded) | < 4.0.7-r0

Wolfi4 products

ruby-3.2All versions (No fix recorded)
ruby-3.3< 3.3.12-r5
ruby-3.4All versions (No fix recorded) | < 3.4.10-r7
ruby-4.0All versions (No fix recorded) | < 4.0.7-r0

Alpine1 product

ruby< 3.3.13-r0 | < 3.4.12-r0

Ruby1 product

resolv< 0.3.2 | ≥ 0.4.0, < 0.7.2

5 vendors · 63 products

References

30 links

github.com/ruby/resolvPACKAGE
www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/ARTICLEWEB
access.redhat.com/errata/RHSA-2026:72285Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2525066REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72285.jsonAdvisory
access.redhat.com/security/cve/CVE-2026-80212REPORT
www.cve.org/CVERecord?id=CVE-2026-80212Advisory
nvd.nist.gov/vuln/detail/CVE-2026-80212AdvisoryOval
github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57eaARTICLE

Show all 30 references