Executive brief
Ruby's resolv library, used for DNS name resolution in applications, fails to properly limit memory consumption when processing DNS responses with many unknown record types. An attacker controlling DNS responses (through server hijacking, spoofing, or as a hosting provider) can cause applications to consume unbounded memory by returning crafted responses, eventually forcing service outages through memory exhaustion. Any application that resolves hostnames the attacker influences—such as webhook handlers or URL validators—is at risk.
Technical details
The vulnerability is a resource exhaustion flaw in the resolv gem's DNS message decoding logic. When Resolv::DNS::Message.decode encounters unknown DNS resource record types or SvcParamKey values, it dynamically creates and permanently registers classes in the Resource/SvcParam namespace and a global class-lookup hash. Since DNS type and class fields are 16-bit values, an attacker can craft a single response containing tens of thousands of distinct unknown (type, class) pairs, each causing permanent memory allocation of several kilobytes. Repeated malicious DNS responses accumulate unbounded memory that is never reclaimed by garbage collection, because the constant references keep each class alive. The attack requires network-level control of DNS responses but affects any code path calling Resolv::DNS::Message.decode, including applications using resolv-replace for system-wide name resolution interception.
Affected products
- Ruby resolv 0.4.0 through 0.7.1, and 0.3.1 and earlier
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: resolv 0.7.2 released; Ruby 3.3 series update to 0.3.2