Executive brief
The resolv gem for Ruby, used by applications to perform DNS lookups, has a flaw in how it encodes domain names for transmission to DNS servers. An attacker can craft a malicious hostname that causes the application to send DNS queries for a different domain than intended, allowing bypassing of security allowlists and DNS egress filtering. This could enable attackers to redirect traffic or exfiltrate data through unintended destinations.
Technical details
The Resolv::DNS::MessageEncoder component in resolv gem before 0.7.2 fails to validate DNS label length constraints before encoding. The put_string and put_label methods pack label lengths into a single octet without range checking, causing labels longer than 255 octets to have their length stored modulo 256. Since RFC 1035 reserves the high two bits of the length octet for compression pointers and limits labels to 63 octets, attacker-controlled values in the 0xC0-0xFF range create malformed wire-format names that parsers interpret as compression pointers. An attacker who can control hostname resolution (via application input) can craft names where a validated hostname suffix becomes padding on the wire, effectively bypassing allowlist validation and DNS egress controls. The vulnerability requires the application to accept attacker-controlled hostnames for resolution but no authentication bypass; patches are available in resolv 0.7.2 and later.
Affected products
- Ruby resolv before 0.7.2
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: resolv 0.7.2 and later