CVE-2026-80212: 
Ruby vulnerability analysis and mitigation

CVE-2026-80212 is a memory exhaustion (Denial of Service) vulnerability in the Ruby resolv gem, a default gem included with standard Ruby installations. The flaw causes unbounded memory growth when a Ruby application decodes DNS responses containing unknown resource record types, allowing an attacker who controls a DNS server to crash the target process. Affected versions are resolv before 0.3.2 and versions 0.4.0 through before 0.7.2. It was disclosed on August 27, 2026, with a CVSS v3.1 base score of 7.5 (High) (Ruby Advisory, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The methods Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create dynamically generate a new Ruby class for each unknown DNS resource record (type, class) pair or unknown SvcParamKey encountered during response decoding. Each generated class is permanently registered as a Ruby constant on Resource (or SvcParam::Generic) and inserted into a ClassHash lookup table. Because the constant holds a reference to the class, Ruby's garbage collector cannot reclaim it even after the DNS response is discarded. Since DNS type and class fields are each 16-bit values, an attacker has up to 2^32 distinct (type, class) combinations to exploit; a single crafted response of a few hundred kilobytes can permanently grow process memory by tens of megabytes, and repeated responses accumulate without bound. Any code path invoking Resolv::DNS::Message.decode on attacker-influenced responses is vulnerable, including scenarios where user-supplied URLs or webhook targets trigger DNS resolution (Ruby Advisory, GitHub Advisory).

Successful exploitation causes unbounded memory growth in the affected Ruby process, ultimately leading to process crash and service unavailability (Denial of Service). There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Because resolv is a default gem shipped with every standard Ruby installation, any Ruby application that performs DNS resolution on attacker-influenced hostnames (e.g., user-supplied URLs, webhook endpoints, or redirect targets) is potentially affected without requiring any additional dependencies (Ruby Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is rated automatable by NVD SSVC, meaning exploitation does not require human interaction and can be triggered remotely with no privileges. The EPSS score is approximately 0.49–0.57%, placing it around the 45th percentile for exploitation probability within 30 days. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Set up a malicious DNS server: Configure a rogue authoritative DNS server (e.g., using tools like dnsmasq, CoreDNS, or a custom script) capable of returning crafted DNS responses containing tens of thousands of distinct unknown resource record (type, class) pairs.
2. Identify a target: Find a Ruby application that performs DNS resolution on attacker-influenced input — such as a web service that fetches user-supplied URLs, processes webhooks, or follows HTTP redirects, causing it to resolve attacker-controlled hostnames.
3. Direct the target to resolve attacker-controlled hostnames: Supply a URL or hostname that resolves through the attacker's malicious DNS server (e.g., via a webhook URL, SSRF vector, or DNS delegation).
4. Send crafted DNS responses: Have the malicious DNS server respond with messages containing large numbers of unknown resource record types (up to ~2^32 unique (type, class) pairs). A single response of a few hundred kilobytes with tens of thousands of distinct unknown types can grow the target process memory by tens of megabytes.
5. Repeat to exhaust memory: Send repeated crafted responses; since allocated classes are never garbage collected, memory grows without bound until the Ruby process exhausts available memory and crashes, causing a denial of service (Ruby Advisory, GitHub Advisory).

• Process Behavior: Steadily increasing RSS/heap memory usage in Ruby application processes without a corresponding increase in legitimate workload; process OOM (Out of Memory) kills or crashes with no apparent application-level error.
• Logs: Application logs showing repeated DNS resolution attempts for unusual or attacker-controlled hostnames; OOM killer entries in system logs (/var/log/syslog, dmesg) referencing the Ruby process.
• Network: Outbound DNS queries to unexpected or external nameservers; DNS responses of unusually large size (hundreds of kilobytes) from upstream resolvers; high volume of DNS queries for a single or small set of hostnames.
• System Metrics: Sudden spikes in process memory consumption visible in monitoring tools (e.g., Prometheus, Datadog) correlated with DNS resolution activity; swap usage increases or memory pressure alerts.

Upgrade the resolv gem to version 0.7.2 or later, which fixes the unbounded class registration behavior (Ruby Advisory). For versions prior to 0.4.0, upgrade to at least 0.3.2. As interim workarounds: restrict DNS resolution to trusted, internal nameservers only; implement rate limiting on hostname resolution requests; validate and sanitize user-supplied URLs and webhook targets before performing DNS lookups; and set memory limits (e.g., via cgroups or ulimit) on Ruby application processes to contain the impact of memory exhaustion.

The vulnerability was published by the Ruby security team on August 27, 2026, alongside a companion advisory (CVE-2026-80213) for the same resolv gem (Ruby Advisory). Red Hat issued a security advisory covering hardened image RPMs in response to this CVE. No significant independent researcher commentary or broad social media discussion has been observed beyond standard vulnerability tracking and aggregation sites.