{"schema_version":"1","data":[{"id":19323,"advisory_id":"0bdd03df-addd-47ae-8dc4-719deabe5cc6","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/","source_published_at":"2026-08-27T00:00:00+00:00","published_at":"2026-10-25T02:56:23.183655+00:00","extraction_method":"llm","technologies":["resolv-gem","ruby"],"cve_ids":["CVE-2026-80212","CVE-2026-80213"],"event_types":["patch"],"payload":{"kind":"patch","title":"Security advisories: CVE-2026-80212 and CVE-2026-80213","summary":"Two vulnerabilities affect the resolv gem: malicious DNS responses can cause unbounded memory use, and overlong hostnames can bypass hostname validation. Upgrade to resolv 0.7.2, or 0.3.2 for Ruby 3.3; Ruby 3.2 users should install resolv 0.7.2 because no 0.2.x release is planned.","evidence":"Two vulnerabilities have been discovered in the resolv gem bundled with Ruby.","products":[{"name":{"value":"resolv gem","evidence":"Affected versions resolv gem 0.4.0 through 0.7.1"},"prerequisites":[{"value":"Only code that resolves names through this gem is affected.","evidence":"Only code that resolves names through this gem is affected."},{"value":"This requires a hostname that exceeds the DNS length limits","evidence":"This requires a hostname that exceeds the DNS length limits, so validation that rejects names longer than 255 octets, or labels longer than 63 octets, is not affected."}],"fixed_versions":[{"value":"0.7.2","evidence":"Update the resolv gem to 0.7.2."},{"value":"0.3.2","evidence":"For the Ruby 3.3 series, update to 0.3.2."},{"value":"0.7.2","evidence":"Install resolv 0.7.2 there instead."}],"affected_versions":[{"value":"0.4.0 through 0.7.1","evidence":"Affected versions resolv gem 0.4.0 through 0.7.1"},{"value":"0.3.1 and earlier","evidence":"resolv gem 0.3.1 and earlier"},{"value":"0.2.x","evidence":"No release is planned for the 0.2.x line that the Ruby 3.2 series ships"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-80212","evidence":"They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213."},{"value":"CVE-2026-80213","evidence":"They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213."}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19315,"advisory_id":"141b25b5-6292-4e7e-b52e-b1ec72d82e72","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/","source_published_at":"2026-10-23T04:24:46+00:00","published_at":"2026-10-25T02:32:23.015644+00:00","extraction_method":"llm","technologies":["resolv","ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-80212","CVE-2026-80213","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 3.3.13 Released","summary":"Ruby 3.3.13 includes security fixes, including an updated resolv gem and fixes for Regexp compilation bugs.","evidence":"Ruby 3.3.13 has been released. This release includes security fixes.","products":[{"name":{"value":"Ruby","evidence":"Ruby 3.3.13 has been released."},"prerequisites":[],"fixed_versions":[{"value":"3.3.13","evidence":"Ruby 3.3.13 has been released."}],"affected_versions":[]},{"name":{"value":"resolv","evidence":"This release updates the default gem resolv to 0.3.2"},"prerequisites":[],"fixed_versions":[{"value":"0.3.2","evidence":"This release updates the default gem resolv to 0.3.2"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-80212","evidence":"Security advisories: CVE-2026-80212 and CVE-2026-80213"},{"value":"CVE-2026-80213","evidence":"Security advisories: CVE-2026-80212 and CVE-2026-80213"},{"value":"CVE-2026-89078","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-93577","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-97229","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-110264","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19323,"next_before":19315}