CVE-2026-80212

Name of the Vulnerable Software and Affected Versions resolv gem versions prior to 0.7.2

Description An issue exists when decoding DNS responses where the functions Resolv::DNS::Resource.get class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for every unknown DNS resource record (type, class) pair or unknown SvcParamKey encountered. These generated classes are permanently registered as constants and entries in a class-lookup hash (ClassHash), preventing them from being reclaimed by garbage collection. An attacker controlling DNS responses can send a large number of distinct unknown types, causing process memory to grow without bound, leading to a denial of service. Any code path utilizing Resolv::DNS::Message.decode on attacker-influenced responses is affected.

Recommendations Update resolv gem to version 0.7.2 or later.