Two vulnerabilities were found in the resolv gem bundled with Ruby: CVE-2026-80212, a memory exhaustion issue triggered by malicious DNS responses from attacker-controlled name servers, and CVE-2026-80213, a hostname validation bypass that lets an SSRF filter approve one hostname while the library resolves a different one due to overlong DNS names. Affected versions span resolv 0.3.1 and earlier through 0.7.1, covering Ruby 3.2, 3.3, 3.4, and 4.0. Only code that actually calls Resolv, loads resolv-replace, or depends on something that does is exposed; ordinary Net::HTTP/TCPSocket usage relies on the OS resolver and is unaffected. Fixes are available in resolv 0.7.2 (all series) and 0.3.2 (Ruby 3.3 line); no separate patch is planned for the Ruby 3.2 line since it has reached end of life, so upgrading to 0.7.2 there is recommended instead.
Table of contents
CVE-2026-80212: Memory exhaustion through malicious DNS responsesCVE-2026-80213: Hostname validation bypassAffected versionsWhat to checkRecommended actionCreditsHistoryQuestions this post answers
What does CVE-2026-80213 in the Ruby resolv gem actually allow an attacker to do?
It lets an attacker bypass hostname allow-list or SSRF validation checks by exploiting a mismatch between the hostname string that passes validation and the name actually resolved over the network. This requires a hostname exceeding DNS length limits (255 octets total or 63-octet labels), so validation rejecting names longer than these limits is not affected. Affects resolv gem 0.7.1 and earlier. Track SSRF-relevant CVEs like this one on daily.dev to keep validation logic ahead of attackers.
How do I fix CVE-2026-80212 and CVE-2026-80213 in the Ruby resolv gem?
Update the resolv gem to version 0.7.2 for most Ruby series, or to 0.3.2 specifically for the Ruby 3.3 line. Ruby 4.0 ships resolv 0.7.0, Ruby 3.4 ships 0.7.1, and Ruby 3.3 ships 0.3.1, all vulnerable. No dedicated patch exists for the 0.2.x line bundled with Ruby 3.2 since that series has reached end of life; install resolv 0.7.2 there instead. daily.dev surfaces gem security advisories so Ruby teams patch before end-of-life versions become a liability.
Does using Net::HTTP in Ruby expose my app to the resolv gem CVE-2026-80212 memory exhaustion vulnerability?
No, ordinary socket connections including Net::HTTP and anything built on TCPSocket use the operating system resolver rather than the resolv gem, so they are not affected. Net::HTTP does load the resolv gem, but only for its IP address regular expressions, so simply having the gem loaded is not itself a sign of exposure. Only code calling Resolv directly, loading resolv-replace, or depending on something that does is at risk. daily.dev helps developers quickly separate real exposure from false alarms in dependency vulnerability reports.
17 Impressions1 Comment