CVE-2026-80213

Name of the Vulnerable Software and Affected Versions resolv gem versions prior to 0.7.2

Description An issue exists where Resolv::DNS::MessageEncoder writes a DNS label length into a single octet without range validation. When a label exceeds 255 octets, the length is stored modulo 256 while the label data remains unchanged, causing the resulting wire bytes to represent a different name than intended. This occurs because put string uses put pack("C", d.length) and put label fails to restrict values, allowing lengths to fall into reserved ranges (0x40-0xBF) or the compression pointer range (0xC0-0xFF). Additionally, Resolv::DNS::Name.create does not validate per-label or total name length. An attacker can provide a crafted hostname to bypass allowlists and egress checks, as validated suffixes may become padding that is not transmitted. This can lead to recursive resolvers caching responses under an attacker-controlled name and DNS logs recording incorrect data. If a label length falls within the 0xC0-0xFF range, conforming parsers may interpret it as a compression pointer using a subsequent attacker-controlled byte as the offset.

Recommendations Update resolv gem to version 0.7.2 or later.