Vulnerability-Lookup

RHSA-2026:62562

Vulnerability from csaf_redhat - Published: 2026-09-02 09:08 - Updated: 2026-09-06 12:01

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: ruby3.3: * ruby3.3-3.3.10-23.6.hum1 (aarch64, x86_64) * ruby3.3-bundled-gems-3.3.10-23.6.hum1 (aarch64, x86_64) * ruby3.3-default-gems-3.3.10-23.6.hum1 (noarch) * ruby3.3-devel-3.3.10-23.6.hum1 (aarch64, x86_64) * ruby3.3-doc-3.3.10-23.6.hum1 (noarch) * ruby3.3-libs-3.3.10-23.6.hum1 (aarch64, x86_64) * rubygem3.3-bigdecimal-3.1.5-23.6.hum1 (aarch64, x86_64) * rubygem3.3-bundler-2.5.22-23.6.hum1 (noarch) * rubygem3.3-devel-3.5.22-23.6.hum1 (noarch) * rubygem3.3-io-console-0.7.1-23.6.hum1 (aarch64, x86_64) * rubygem3.3-irb-1.13.1-23.6.hum1 (noarch) * rubygem3.3-json-2.7.2-23.6.hum1 (aarch64, x86_64) * rubygem3.3-minitest-5.20.0-23.6.hum1 (noarch) * rubygem3.3-power_assert-2.0.3-23.6.hum1 (noarch) * rubygem3.3-psych-5.1.2-23.6.hum1 (aarch64, x86_64) * rubygem3.3-racc-1.7.3-23.6.hum1 (aarch64, x86_64) * rubygem3.3-rake-13.1.0-23.6.hum1 (noarch) * rubygem3.3-rbs-3.4.0-23.6.hum1 (aarch64, x86_64) * rubygem3.3-rdoc-6.6.3.1-23.6.hum1 (noarch) * rubygem3.3-rexml-3.4.4-23.6.hum1 (noarch) * rubygem3.3-rss-0.3.1-23.6.hum1 (noarch) * rubygem3.3-rubygems-3.5.22-23.6.hum1 (noarch) * rubygem3.3-test-unit-3.6.1-23.6.hum1 (noarch) * rubygem3.3-typeprof-0.21.9-23.6.hum1 (noarch) * ruby3.3-3.3.10-23.6.hum1.src (src) Security Fix(es): ruby3.3: * CVE-2026-80212 * CVE-2026-80213

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-80212

A flaw was found in the resolv gem. An attacker controlling DNS responses (e.g., a spoofed response or a malicious upstream DNS server) can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory growth, as each unknown entry generates a new class that is permanently registered and never reclaimed. Repeated exploitation can result in a Denial of Service (DoS) due to unbounded memory accumulation.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-80213

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of security controls such as allowlists and egress checks, as well as DNS cache poisoning, where a recursive resolver caches an attacker-chosen name instead of the intended one. This also results in inaccurate DNS logs.

4.0 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:ruby3-3-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

17 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:62562	self
https://access.redhat.com/security/cve/CVE-2026-80212	external
https://access.redhat.com/security/cve/CVE-2026-80213	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-80212	self
https://bugzilla.redhat.com/show_bug.cgi?id=2525066	external
https://www.cve.org/CVERecord?id=CVE-2026-80212	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80212	external
https://github.com/ruby/resolv/commit/6393c628b22…	external
https://www.ruby-lang.org/en/news/2026/08/27/mult…	external
https://access.redhat.com/security/cve/CVE-2026-80213	self
https://bugzilla.redhat.com/show_bug.cgi?id=2525014	external
https://www.cve.org/CVERecord?id=CVE-2026-80213	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80213	external
https://github.com/ruby/resolv/commit/b336e42d6a3…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nruby3.3:\n  * ruby3.3-3.3.10-23.6.hum1 (aarch64, x86_64)\n  * ruby3.3-bundled-gems-3.3.10-23.6.hum1 (aarch64, x86_64)\n  * ruby3.3-default-gems-3.3.10-23.6.hum1 (noarch)\n  * ruby3.3-devel-3.3.10-23.6.hum1 (aarch64, x86_64)\n  * ruby3.3-doc-3.3.10-23.6.hum1 (noarch)\n  * ruby3.3-libs-3.3.10-23.6.hum1 (aarch64, x86_64)\n  * rubygem3.3-bigdecimal-3.1.5-23.6.hum1 (aarch64, x86_64)\n  * rubygem3.3-bundler-2.5.22-23.6.hum1 (noarch)\n  * rubygem3.3-devel-3.5.22-23.6.hum1 (noarch)\n  * rubygem3.3-io-console-0.7.1-23.6.hum1 (aarch64, x86_64)\n  * rubygem3.3-irb-1.13.1-23.6.hum1 (noarch)\n  * rubygem3.3-json-2.7.2-23.6.hum1 (aarch64, x86_64)\n  * rubygem3.3-minitest-5.20.0-23.6.hum1 (noarch)\n  * rubygem3.3-power_assert-2.0.3-23.6.hum1 (noarch)\n  * rubygem3.3-psych-5.1.2-23.6.hum1 (aarch64, x86_64)\n  * rubygem3.3-racc-1.7.3-23.6.hum1 (aarch64, x86_64)\n  * rubygem3.3-rake-13.1.0-23.6.hum1 (noarch)\n  * rubygem3.3-rbs-3.4.0-23.6.hum1 (aarch64, x86_64)\n  * rubygem3.3-rdoc-6.6.3.1-23.6.hum1 (noarch)\n  * rubygem3.3-rexml-3.4.4-23.6.hum1 (noarch)\n  * rubygem3.3-rss-0.3.1-23.6.hum1 (noarch)\n  * rubygem3.3-rubygems-3.5.22-23.6.hum1 (noarch)\n  * rubygem3.3-test-unit-3.6.1-23.6.hum1 (noarch)\n  * rubygem3.3-typeprof-0.21.9-23.6.hum1 (noarch)\n  * ruby3.3-3.3.10-23.6.hum1.src (src)\n\nSecurity Fix(es):\n\nruby3.3:\n  * CVE-2026-80212\n  * CVE-2026-80213",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:62562",
        "url": "https://access.redhat.com/errata/RHSA-2026:62562"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80212",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80212"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80213",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80213"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62562.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-06T12:01:33+00:00",
      "generator": {
        "date": "2026-09-06T12:01:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:62562",
      "initial_release_date": "2026-09-02T09:08:39+00:00",
      "revision_history": [
        {
          "date": "2026-09-02T09:08:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-06T12:01:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby3-3-main@aarch64",
                "product": {
                  "name": "ruby3-3-main@aarch64",
                  "product_id": "ruby3-3-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby3.3@3.3.10-23.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby3-3-main@src",
                "product": {
                  "name": "ruby3-3-main@src",
                  "product_id": "ruby3-3-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby3.3@3.3.10-23.6.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby3-3-main@x86_64",
                "product": {
                  "name": "ruby3-3-main@x86_64",
                  "product_id": "ruby3-3-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby3.3@3.3.10-23.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby3-3-main@noarch",
                "product": {
                  "name": "ruby3-3-main@noarch",
                  "product_id": "ruby3-3-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby3.3-default-gems@3.3.10-23.6.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3-3-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby3-3-main@aarch64"
        },
        "product_reference": "ruby3-3-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3-3-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby3-3-main@noarch"
        },
        "product_reference": "ruby3-3-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3-3-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby3-3-main@src"
        },
        "product_reference": "ruby3-3-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby3-3-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:ruby3-3-main@x86_64"
        },
        "product_reference": "ruby3-3-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-80212",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-27T16:56:17.507715+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2525066"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the resolv gem. An attacker controlling DNS responses (e.g., a spoofed response or a malicious upstream DNS server) can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory growth, as each unknown entry generates a new class that is permanently registered and never reclaimed. Repeated exploitation can result in a Denial of Service (DoS) due to unbounded memory accumulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Ruby `resolv` gem, which is part of the Ruby standard library. An attacker can trigger unbounded memory growth by sending specially crafted DNS responses, either through spoofing or a compromised DNS server. This can lead to resource exhaustion and system instability, possibly affecting other applications than those written in Ruby and using the `resolv` gem.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby3-3-main@aarch64",
          "Red Hat Hardened Images:ruby3-3-main@noarch",
          "Red Hat Hardened Images:ruby3-3-main@src",
          "Red Hat Hardened Images:ruby3-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80212"
        },
        {
          "category": "external",
          "summary": "RHBZ#2525066",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525066"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80212",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80212"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80212",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80212"
        },
        {
          "category": "external",
          "summary": "https://github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57ea",
          "url": "https://github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57ea"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/",
          "url": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/"
        }
      ],
      "release_date": "2026-08-27T14:15:04.403000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T09:08:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby3-3-main@aarch64",
            "Red Hat Hardened Images:ruby3-3-main@noarch",
            "Red Hat Hardened Images:ruby3-3-main@src",
            "Red Hat Hardened Images:ruby3-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62562"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:ruby3-3-main@aarch64",
            "Red Hat Hardened Images:ruby3-3-main@noarch",
            "Red Hat Hardened Images:ruby3-3-main@src",
            "Red Hat Hardened Images:ruby3-3-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby3-3-main@aarch64",
            "Red Hat Hardened Images:ruby3-3-main@noarch",
            "Red Hat Hardened Images:ruby3-3-main@src",
            "Red Hat Hardened Images:ruby3-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses"
    },
    {
      "cve": "CVE-2026-80213",
      "cwe": {
        "id": "CWE-130",
        "name": "Improper Handling of Length Parameter Inconsistency"
      },
      "discovery_date": "2026-08-27T16:52:28.921224+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2525014"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of security controls such as allowlists and egress checks, as well as DNS cache poisoning, where a recursive resolver caches an attacker-chosen name instead of the intended one. This also results in inaccurate DNS logs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate impact vulnerability in the Ruby `resolv` gem, which is part of the Ruby standard library. This flaw allows for DNS allowlist and egress bypass, and cache poisoning. When an application processes attacker-controlled hostnames, it can result in DNS queries for unintended domains, potentially circumventing network access restrictions or domain validation checks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:ruby3-3-main@aarch64",
          "Red Hat Hardened Images:ruby3-3-main@noarch",
          "Red Hat Hardened Images:ruby3-3-main@src",
          "Red Hat Hardened Images:ruby3-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80213"
        },
        {
          "category": "external",
          "summary": "RHBZ#2525014",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525014"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80213",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80213"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80213",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80213"
        },
        {
          "category": "external",
          "summary": "https://github.com/ruby/resolv/commit/b336e42d6a3e2a824308f7b47fa26a968641b366",
          "url": "https://github.com/ruby/resolv/commit/b336e42d6a3e2a824308f7b47fa26a968641b366"
        },
        {
          "category": "external",
          "summary": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/",
          "url": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/"
        }
      ],
      "release_date": "2026-08-27T14:22:23.495000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T09:08:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:ruby3-3-main@aarch64",
            "Red Hat Hardened Images:ruby3-3-main@noarch",
            "Red Hat Hardened Images:ruby3-3-main@src",
            "Red Hat Hardened Images:ruby3-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62562"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:ruby3-3-main@aarch64",
            "Red Hat Hardened Images:ruby3-3-main@noarch",
            "Red Hat Hardened Images:ruby3-3-main@src",
            "Red Hat Hardened Images:ruby3-3-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:ruby3-3-main@aarch64",
            "Red Hat Hardened Images:ruby3-3-main@noarch",
            "Red Hat Hardened Images:ruby3-3-main@src",
            "Red Hat Hardened Images:ruby3-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames"
    }
  ]
}

CVE-2026-80212 (GCVE-0-2026-80212)

Vulnerability from cvelistv5 – Published: 2026-08-27 14:15 – Updated: 2026-08-27 19:33

Summary

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 19:33 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/ruby/resolv
https://www.ruby-lang.org/en/news/2026/08/27/mult…

Impacted products

1 product

Vendor	Product	Version
Ruby	resolv	Affected: 0 , < 0.3.2 (semver) Affected: 0.4.0 , < 0.7.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80212",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T19:33:50.602678Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T19:33:58.773Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/resolv",
          "product": "resolv",
          "vendor": "Ruby",
          "versions": [
            {
              "lessThan": "0.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.7.2",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T14:15:04.403Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/ruby/resolv"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-80212",
    "datePublished": "2026-08-27T14:15:04.403Z",
    "dateReserved": "2026-08-26T01:42:16.295Z",
    "dateUpdated": "2026-08-27T19:33:58.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80213 (GCVE-0-2026-80213)

Vulnerability from cvelistv5 – Published: 2026-08-27 14:22 – Updated: 2026-08-27 17:52

Summary

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a label to 63 octets, and the two high bits of the length octet are reserved for compression pointers. put_string packed the length with put_pack("C", d.length) and put_label used it for labels, and thus any value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the 0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname suffix that the application validates against an allowlist becomes padding that never appears on the wire, and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the attacker's name, and DNS logs record that name rather than the one the application asked for. A label length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read as the start of a compression pointer, with the following attacker-controlled byte as the offset.

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 17:51 UTC

CWE

CWE-197 - Numeric Truncation Error

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/ruby/resolv
https://www.ruby-lang.org/en/news/2026/08/27/mult…

Impacted products

1 product

Vendor	Product	Version
Ruby	resolv	Affected: 0 , < 0.3.2 (semver) Affected: 0.4.0 , < 0.7.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T17:51:54.378639Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T17:52:14.240Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/resolv",
          "product": "resolv",
          "vendor": "Ruby",
          "versions": [
            {
              "lessThan": "0.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "0.7.2",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label\u0027s length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a label to 63 octets, and the two high bits of the length octet are reserved for compression pointers. put_string packed the length with put_pack(\"C\", d.length) and put_label used it for labels, and thus any value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the 0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname suffix that the application validates against an allowlist becomes padding that never appears on the wire, and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the attacker\u0027s name, and DNS logs record that name rather than the one the application asked for. A label length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read as the start of a compression pointer, with the following attacker-controlled byte as the offset."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-197",
              "description": "CWE-197 Numeric Truncation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T14:22:23.495Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/ruby/resolv"
        },
        {
          "url": "https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-80213",
    "datePublished": "2026-08-27T14:22:23.495Z",
    "dateReserved": "2026-08-26T01:45:16.494Z",
    "dateUpdated": "2026-08-27T17:52:14.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:62562

CVE-2026-80212 (GCVE-0-2026-80212)

CVE-2026-80213 (GCVE-0-2026-80213)

Tags

Sightings

Nomenclature