# CVE-2026-80212: Ruby resolv memory exhaustion in DNS response parsing

Source: https://junglewise.ai/threats/cve-2026-80212-ruby-resolv-memory-exhaustion-in-dns-response-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80212 · Severity: high · CVSS 7.5 · Published 2026-08-27

Ruby's resolv library, used for DNS name resolution in applications, fails to properly limit memory consumption when processing DNS responses with many unknown record types. An attacker controlling DNS responses (through server hijacking, spoofing, or as a hosting provider) can cause applications to consume unbounded memory by returning crafted responses, eventually forcing service outages through memory exhaustion. Any application that resolves hostnames the attacker influences—such as webhook handlers or URL validators—is at risk.

Vendors: [Ruby](https://junglewise.ai/threats/vendors/ruby).

## Quick answers

**Is CVE-2026-80212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80212 being exploited in the wild.

**How severe is CVE-2026-80212?** High severity, with a CVSS score of 7.5, published 27 August 2026.

**Which products and versions are affected?** Ruby Resolv 0.4.0 through 0.7.1, and 0.3.1 and earlier.

**Is there a fix for CVE-2026-80212?** A patch was published on 2026-08-27: resolv 0.7.2 released; Ruby 3.3 series update to 0.3.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80212 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-80212?** Check whether you run Ruby Resolv at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion flaw in the resolv gem's DNS message decoding logic. When Resolv::DNS::Message.decode encounters unknown DNS resource record types or SvcParamKey values, it dynamically creates and permanently registers classes in the Resource/SvcParam namespace and a global class-lookup hash. Since DNS type and class fields are 16-bit values, an attacker can craft a single response containing tens of thousands of distinct unknown (type, class) pairs, each causing permanent memory allocation of several kilobytes. Repeated malicious DNS responses accumulate unbounded memory that is never reclaimed by garbage collection, because the constant references keep each class alive. The attack requires network-level control of DNS responses but affects any code path calling Resolv::DNS::Message.decode, including applications using resolv-replace for system-wide name resolution interception.

## Affected products

- Ruby resolv 0.4.0 through 0.7.1, and 0.3.1 and earlier

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: patched: resolv 0.7.2 released; Ruby 3.3 series update to 0.3.2

## References

- [https://github.com/ruby/resolv](https://github.com/ruby/resolv)
- [https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/](https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/)

## Related threats

- [Ruby resolv DNS label encoding bypass](https://junglewise.ai/threats/cve-2026-80213-ruby-resolv-dns-label-encoding-bypass)