Resource exhaustion in resolv - CVE-2026-80212

Vulnerability identifier: #VU145888

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80212

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the resolv DNS resolution logic when processing malicious DNS responses from an attacker-controlled name server. A remote attacker can return crafted DNS responses that are retained permanently to cause a denial of service.

Only applications that resolve hostnames an attacker can influence through this gem are affected.

resolv
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openEuler
Anolis OS
Fedora
rubygem-net-telnet
rubygem-rss
rubygem-xmlrpc
rubygem-io-console
rubygem-typeprof
rubygem-power_assert
rubygem-did_you_mean
rubygem-bigdecimal
rubygem-rbs
rubygem-racc
rubygem-irb
rubygem-json
rubygem-openssl
rubygem-bundler
ruby
ruby-irb
ruby-help
ruby-devel
ruby-debugsource
ruby-debuginfo
rubygems-devel
rubygems
rubygem-psych
rubygem-rexml
rubygem-test-unit
ruby-libs
ruby-bundled-gems
ruby-default-gems
ruby-doc
ruby (Red Hat package)
ruby4.0 (Red Hat package)
rubygem-minitest
rubygem-rdoc
rubygem-rake

Install security update from vendor's website.

resolv - addressed in versions 0.3.2, 0.7.2
rubygem-net-telnet - update to 0.1.1-143
rubygem-rss - update to 0.2.9-150
rubygem-xmlrpc - update to 0.3.0-143
rubygem-rss - update to 0.3.1-11
rubygem-io-console - addressed in versions 0.4.6-143, 0.5.7-150
rubygem-io-console - update to 0.7.1-11
rubygem-typeprof - update to 0.15.2-150
rubygem-typeprof - update to 0.21.9-11
rubygem-power_assert - update to 1.1.1-143
rubygem-did_you_mean - addressed in versions 1.2.0-143, 1.5.0-150
rubygem-bigdecimal - addressed in versions 1.3.4-143, 3.0.0-150
rubygem-rbs - update to 1.4.0-150
rubygem-racc - update to 1.7.3-11
rubygem-irb - update to 1.13.1-11
rubygem-power_assert - update to 2.0.3-11
rubygem-json - addressed in versions 2.1.0-143, 2.5.1-150
rubygem-openssl - addressed in versions 2.1.2-143, 2.2.1-150
rubygem-bundler - update to 2.2.32-150
ruby - addressed in versions 2.5.8-143, 3.0.3-150
ruby-irb - addressed in versions 2.5.8-143, 3.0.3-150
ruby-help - addressed in versions 2.5.8-143, 3.0.3-150
ruby-devel - addressed in versions 2.5.8-143, 3.0.3-150
ruby-debugsource - addressed in versions 2.5.8-143, 3.0.3-150
ruby-debuginfo - addressed in versions 2.5.8-143, 3.0.3-150
rubygem-bundler - update to 2.5.22-11
rubygem-json - update to 2.7.2-11
rubygems-devel - addressed in versions 2.7.6-143, 3.2.32-150
rubygems - addressed in versions 2.7.6-143, 3.2.32-150
rubygem-psych - addressed in versions 3.0.2-143, 3.3.2-150
rubygem-bigdecimal - update to 3.1.5-11
rubygem-rexml - update to 3.2.5-150
rubygem-test-unit - addressed in versions 3.2.7-143, 3.3.7-150
ruby-libs - update to 3.3.9-11
rubygem-rexml - update to 3.3.9-11
ruby-devel - update to 3.3.9-11
ruby-bundled-gems - update to 3.3.9-11
ruby - update to 3.3.9-11
ruby-default-gems - update to 3.3.9-11
ruby-doc - update to 3.3.9-11
ruby (Red Hat package) - update to 3.3.12-15.el10_2
rubygem-rbs - update to 3.4.0-11
ruby - addressed in versions 3.4.10-32.fc43, 4.0.6-38.fc44, 4.0.6-38.fc45, 4.0.6-38.fc46
rubygems-devel - update to 3.5.22-11
rubygems - update to 3.5.22-11
rubygem-test-unit - update to 3.6.1-11
ruby4.0 (Red Hat package) - update to 4.0.6-37.el10_2
rubygems - addressed in versions 4.0.20-1.fc44, 4.0.20-1.fc45, 4.0.20-1.fc46
rubygem-psych - update to 5.1.2-11
rubygem-minitest - addressed in versions 5.10.3-143, 5.14.2-150
rubygem-minitest - update to 5.20.0-11
rubygem-rdoc - addressed in versions 6.0.1.1-143, 6.3.3-150
rubygem-rdoc - update to 6.6.3.1-11
rubygem-rake - addressed in versions 12.3.0-143, 13.0.3-150
rubygem-rake - update to 13.1.0-11

• https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/

• Multiple vulnerabilities in Ruby resolv gem
• openEuler 22.03 LTS SP4 update for ruby
• openEuler 20.03 LTS SP4 update for ruby
• Fedora 46 update for rubygems
• Fedora 45 update for rubygems
• Fedora 44 update for rubygems
• Fedora 46 update for ruby
• Fedora 45 update for ruby
• Fedora 44 update for ruby
• Fedora 43 update for ruby
• Anolis OS update for ruby
• Red Hat Enterprise Linux 10 update for ruby4.0
• Red Hat Enterprise Linux 9 update for the ruby:4.0 module
• Red Hat Enterprise Linux 9 update for the ruby:3.3 module
• Red Hat Enterprise Linux 10 update for ruby