Input validation error in resolv - CVE-2026-80213

Vulnerability identifier: #VU145889

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80213

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass hostname validation restrictions.

The vulnerability exists due to improper input validation in the resolv hostname resolution logic when resolving a hostname after it has been checked against an allow list or SSRF filter. A remote attacker can supply a crafted hostname so that the validated string and the name sent to the network differ to bypass hostname validation restrictions.

This requires a hostname that exceeds DNS length limits.

resolv
openEuler
Fedora
rubygem-rss
rubygem-io-console
rubygem-typeprof
rubygem-did_you_mean
rubygem-json
rubygem-rbs
rubygem-openssl
rubygem-bigdecimal
ruby-debuginfo
ruby-help
ruby-irb
ruby-devel
ruby-debugsource
ruby-bundled-gems
ruby
rubygem-rexml
rubygems-devel
rubygems
rubygem-test-unit
rubygem-psych
rubygem-minitest
rubygem-rdoc
rubygem-rake

Install security update from vendor's website.

resolv - addressed in versions 0.3.2, 0.7.2
rubygem-rss - update to 0.2.9-161
rubygem-io-console - update to 0.6.0-161
rubygem-typeprof - update to 0.21.3-161
rubygem-did_you_mean - update to 1.6.3-161
rubygem-json - update to 2.6.3-161
rubygem-rbs - update to 2.8.2-161
rubygem-openssl - update to 3.1.0-161
rubygem-bigdecimal - update to 3.1.3-161
ruby-debuginfo - update to 3.2.2-161
ruby-help - update to 3.2.2-161
ruby-irb - update to 3.2.2-161
ruby-devel - update to 3.2.2-161
ruby-debugsource - update to 3.2.2-161
ruby-bundled-gems - update to 3.2.2-161
ruby - update to 3.2.2-161
rubygem-rexml - update to 3.2.5-161
ruby - addressed in versions 3.4.10-32.fc43, 4.0.6-38.fc44, 4.0.6-38.fc45, 4.0.6-38.fc46
rubygems-devel - update to 3.4.10-161
rubygems - update to 3.4.10-161
rubygem-test-unit - update to 3.5.7-161
rubygems - addressed in versions 4.0.20-1.fc44, 4.0.20-1.fc45, 4.0.20-1.fc46
rubygem-psych - update to 5.0.1-161
rubygem-minitest - update to 5.16.3-161
rubygem-rdoc - update to 6.5.0-161
rubygem-rake - update to 13.0.6-161

• https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/

• Multiple vulnerabilities in Ruby resolv gem
• Fedora 46 update for rubygems
• Fedora 45 update for rubygems
• Fedora 44 update for rubygems
• Fedora 46 update for ruby
• Fedora 45 update for ruby
• Fedora 44 update for ruby
• Fedora 43 update for ruby
• openEuler 24.03 LTS SP3 update for ruby