Security advisories: CVE-2026-80212 and CVE-2026-80213
Two vulnerabilities affect the resolv gem: malicious DNS responses can cause unbounded memory use, and overlong hostnames can bypass hostname validation. Upgrade to resolv 0.7.2, or 0.3.2 for Ruby 3.3; Ruby 3.2 users should install resolv 0.7.2 because no 0.2.x release is planned.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Two vulnerabilities have been discovered in the resolv gem bundled with Ruby.
resolv gem
Affected versions resolv gem 0.4.0 through 0.7.1
- Affected versions
- 0.4.0 through 0.7.1
Affected versions resolv gem 0.4.0 through 0.7.1
0.3.1 and earlierresolv gem 0.3.1 and earlier
0.2.xNo release is planned for the 0.2.x line that the Ruby 3.2 series ships
- Fixed versions
- 0.7.2
Update the resolv gem to 0.7.2.
0.3.2For the Ruby 3.3 series, update to 0.3.2.
0.7.2Install resolv 0.7.2 there instead.
- Prerequisites
- Only code that resolves names through this gem is affected.
Only code that resolves names through this gem is affected.
This requires a hostname that exceeds the DNS length limitsThis requires a hostname that exceeds the DNS length limits, so validation that rejects names longer than 255 octets, or labels longer than 63 octets, is not affected.
- Related CVEs
- CVE-2026-80212
They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213.
CVE-2026-80213They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213.
Publisher severity
No explicit severity was extracted.