# CVE-2026-80213: Ruby resolv DNS label encoding bypass

Source: https://junglewise.ai/threats/cve-2026-80213-ruby-resolv-dns-label-encoding-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80213 · Severity: medium · CVSS 4 · Published 2026-08-27

The resolv gem for Ruby, used by applications to perform DNS lookups, has a flaw in how it encodes domain names for transmission to DNS servers. An attacker can craft a malicious hostname that causes the application to send DNS queries for a different domain than intended, allowing bypassing of security allowlists and DNS egress filtering. This could enable attackers to redirect traffic or exfiltrate data through unintended destinations.

Vendors: [Ruby](https://junglewise.ai/threats/vendors/ruby).

## Quick answers

**Is CVE-2026-80213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80213 being exploited in the wild.

**How severe is CVE-2026-80213?** Medium severity, with a CVSS score of 4, published 27 August 2026.

**Which products and versions are affected?** Ruby Resolv before 0.7.2.

**Is there a fix for CVE-2026-80213?** A patch was published on 2026-08-27: resolv 0.7.2 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80213 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-80213?** Check whether you run Ruby Resolv at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Resolv::DNS::MessageEncoder component in resolv gem before 0.7.2 fails to validate DNS label length constraints before encoding. The put_string and put_label methods pack label lengths into a single octet without range checking, causing labels longer than 255 octets to have their length stored modulo 256. Since RFC 1035 reserves the high two bits of the length octet for compression pointers and limits labels to 63 octets, attacker-controlled values in the 0xC0-0xFF range create malformed wire-format names that parsers interpret as compression pointers. An attacker who can control hostname resolution (via application input) can craft names where a validated hostname suffix becomes padding on the wire, effectively bypassing allowlist validation and DNS egress controls. The vulnerability requires the application to accept attacker-controlled hostnames for resolution but no authentication bypass; patches are available in resolv 0.7.2 and later.

## Affected products

- Ruby resolv before 0.7.2

## Timeline

- 2026-08-27: disclosed
- 2026-08-27: patched: resolv 0.7.2 and later

## Related threats

- [Ruby resolv memory exhaustion in DNS response parsing](https://junglewise.ai/threats/cve-2026-80212-ruby-resolv-memory-exhaustion-in-dns-response-parsing)