CVE-2026-80212

Upstream information

CVE-2026-80212 at MITRE

Description

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores

CVSS detail	CNA (MITRE)
Base Score	7.5
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	None
Integrity Impact	None
Availability Impact	High
CVSSv3 Version	3.1

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

• RHSA-2026:72285, published Mon Sep 28 15:07:48 UTC 2026
• RHSA-2026:72286, published Mon Sep 28 15:07:48 UTC 2026
• RHSA-2026:72427, published Tue Sep 29 15:07:43 UTC 2026
• RHSA-2026:72484, published Tue Sep 29 15:07:45 UTC 2026
• RHSA-2026:72485, published Tue Sep 29 15:07:45 UTC 2026
• RHSA-2026:72785, published Tue Sep 29 15:07:43 UTC 2026
• RHSA-2026:73519, published Thu Oct 1 15:07:34 UTC 2026
• RHSA-2026:83571, published Tue Oct 20 15:07:54 UTC 2026

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 10	ruby >= 3.3.12-15.el10_2 ruby-bundled-gems >= 3.3.12-15.el10_2 ruby-default-gems >= 3.3.12-15.el10_2 ruby-devel >= 3.3.12-15.el10_2 ruby-doc >= 3.3.12-15.el10_2 ruby-libs >= 3.3.12-15.el10_2 ruby4.0 >= 4.0.6-37.el10_2 ruby4.0-devel >= 4.0.6-37.el10_2 ruby4.0-doc >= 4.0.6-37.el10_2 ruby4.0-rubygem-mysql2 >= 0.5.7-37.el10_2 ruby4.0-rubygem-pg >= 1.6.3-37.el10_2 rubygem-bigdecimal >= 3.1.5-15.el10_2 rubygem-bundler >= 2.5.22-15.el10_2 rubygem-io-console >= 0.7.1-15.el10_2 rubygem-irb >= 1.13.1-15.el10_2 rubygem-json >= 2.7.2-15.el10_2 rubygem-minitest >= 5.20.0-15.el10_2 rubygem-power_assert >= 2.0.3-15.el10_2 rubygem-psych >= 5.1.2-15.el10_2 rubygem-racc >= 1.7.3-15.el10_2 rubygem-rake >= 13.1.0-15.el10_2 rubygem-rbs >= 3.4.0-15.el10_2 rubygem-rdoc >= 6.6.3.1-15.el10_2 rubygem-rexml >= 3.4.4-15.el10_2 rubygem-rss >= 0.3.1-15.el10_2 rubygem-test-unit >= 3.6.1-15.el10_2 rubygem-typeprof >= 0.21.9-15.el10_2 rubygems >= 3.5.22-15.el10_2 rubygems-devel >= 3.5.22-15.el10_2	Patchnames: RHSA-2026:72427 (x86_64) RHSA-2026:72785 (x86_64)
SUSE Liberty Linux 8	ruby >= 3.3.12-9.module+el8.10.0+24850+a62b5b25 ruby-bundled-gems >= 3.3.12-9.module+el8.10.0+24850+a62b5b25 ruby-default-gems >= 3.3.12-9.module+el8.10.0+24850+a62b5b25 ruby-devel >= 3.3.12-9.module+el8.10.0+24850+a62b5b25 ruby-doc >= 3.3.12-9.module+el8.10.0+24850+a62b5b25 ruby-irb >= 2.5.9-116.module+el8.10.0+24853+52b5af56 ruby-libs >= 3.3.12-9.module+el8.10.0+24850+a62b5b25 rubygem-abrt >= 0.4.0-1.module+el8.10.0+21226+b78a28c4 rubygem-abrt-doc >= 0.4.0-1.module+el8.10.0+21226+b78a28c4 rubygem-bigdecimal >= 3.1.5-9.module+el8.10.0+24850+a62b5b25 rubygem-bson >= 4.3.0-2.module+el8.9.0+19193+435404ae rubygem-bson-doc >= 4.3.0-2.module+el8.9.0+19193+435404ae rubygem-bundler >= 2.5.22-9.module+el8.10.0+24850+a62b5b25 rubygem-bundler-doc >= 1.16.1-5.module+el8.10.0+23088+750dc6ca rubygem-did_you_mean >= 1.2.0-116.module+el8.10.0+24853+52b5af56 rubygem-io-console >= 0.7.1-9.module+el8.10.0+24850+a62b5b25 rubygem-irb >= 1.13.1-9.module+el8.10.0+24850+a62b5b25 rubygem-json >= 2.7.2-9.module+el8.10.0+24850+a62b5b25 rubygem-minitest >= 5.20.0-9.module+el8.10.0+24850+a62b5b25 rubygem-mongo >= 2.5.1-3.module+el8.10.0+24944+b1921893 rubygem-mongo-doc >= 2.5.1-3.module+el8.10.0+24944+b1921893 rubygem-mysql2 >= 0.5.5-1.module+el8.10.0+21226+b78a28c4 rubygem-mysql2-doc >= 0.5.5-1.module+el8.10.0+21226+b78a28c4 rubygem-net-telnet >= 0.1.1-116.module+el8.10.0+24853+52b5af56 rubygem-openssl >= 2.1.2-116.module+el8.10.0+24853+52b5af56 rubygem-pg >= 1.5.4-1.module+el8.10.0+21226+b78a28c4 rubygem-pg-doc >= 1.5.4-1.module+el8.10.0+21226+b78a28c4 rubygem-power_assert >= 2.0.3-9.module+el8.10.0+24850+a62b5b25 rubygem-psych >= 5.1.2-9.module+el8.10.0+24850+a62b5b25 rubygem-racc >= 1.7.3-9.module+el8.10.0+24850+a62b5b25 rubygem-rake >= 13.1.0-9.module+el8.10.0+24850+a62b5b25 rubygem-rbs >= 3.4.0-9.module+el8.10.0+24850+a62b5b25 rubygem-rdoc >= 6.6.3.1-9.module+el8.10.0+24850+a62b5b25 rubygem-rexml >= 3.4.4-9.module+el8.10.0+24850+a62b5b25 rubygem-rss >= 0.3.1-9.module+el8.10.0+24850+a62b5b25 rubygem-test-unit >= 3.6.1-9.module+el8.10.0+24850+a62b5b25 rubygem-typeprof >= 0.21.9-9.module+el8.10.0+24850+a62b5b25 rubygem-xmlrpc >= 0.3.0-116.module+el8.10.0+24853+52b5af56 rubygems >= 3.5.22-9.module+el8.10.0+24850+a62b5b25 rubygems-devel >= 3.5.22-9.module+el8.10.0+24850+a62b5b25	Patchnames: RHSA-2026:72285 (i686,x86_64) RHSA-2026:73519 (i686,x86_64)
SUSE Liberty Linux 9.6 EMS	ruby >= 3.0.7-166.el9_6 ruby-default-gems >= 3.0.7-166.el9_6 ruby-devel >= 3.0.7-166.el9_6 ruby-doc >= 3.0.7-166.el9_6 ruby-libs >= 3.0.7-166.el9_6 rubygem-bigdecimal >= 3.0.0-166.el9_6 rubygem-bundler >= 2.2.33-166.el9_6 rubygem-io-console >= 0.5.7-166.el9_6 rubygem-irb >= 1.3.5-166.el9_6 rubygem-json >= 2.5.1-166.el9_6 rubygem-minitest >= 5.14.2-166.el9_6 rubygem-power_assert >= 1.2.1-166.el9_6 rubygem-psych >= 3.3.2-166.el9_6 rubygem-rake >= 13.0.3-166.el9_6 rubygem-rbs >= 1.4.0-166.el9_6 rubygem-rdoc >= 6.3.4.1-166.el9_6 rubygem-rexml >= 3.2.5-166.el9_6 rubygem-rss >= 0.2.9-166.el9_6 rubygem-test-unit >= 3.3.7-166.el9_6 rubygem-typeprof >= 0.15.2-166.el9_6 rubygems >= 3.2.33-166.el9_6 rubygems-devel >= 3.2.33-166.el9_6	Patchnames: RHSA-2026:83571 (i686,x86_64)
SUSE Liberty Linux 9	ruby >= 4.0.6-35.module+el9.8.0+24852+4534d062 ruby-bundled-gems >= 4.0.6-35.module+el9.8.0+24852+4534d062 ruby-default-gems >= 4.0.6-35.module+el9.8.0+24852+4534d062 ruby-devel >= 4.0.6-35.module+el9.8.0+24852+4534d062 ruby-doc >= 4.0.6-35.module+el9.8.0+24852+4534d062 ruby-libs >= 4.0.6-35.module+el9.8.0+24852+4534d062 rubygem-bigdecimal >= 4.0.1-35.module+el9.8.0+24852+4534d062 rubygem-bundler >= 4.0.16-35.module+el9.8.0+24852+4534d062 rubygem-io-console >= 0.8.2-35.module+el9.8.0+24852+4534d062 rubygem-irb >= 1.16.0-35.module+el9.8.0+24852+4534d062 rubygem-json >= 2.18.0-35.module+el9.8.0+24852+4534d062 rubygem-minitest >= 6.0.0-35.module+el9.8.0+24852+4534d062 rubygem-mysql2 >= 0.5.7-1.module+el9.8.0+24428+77f1d00a rubygem-mysql2-doc >= 0.5.7-1.module+el9.8.0+24428+77f1d00a rubygem-pg >= 1.6.3-1.module+el9.8.0+24428+77f1d00a rubygem-pg-doc >= 1.6.3-1.module+el9.8.0+24428+77f1d00a rubygem-power_assert >= 3.0.1-35.module+el9.8.0+24852+4534d062 rubygem-psych >= 5.3.1-35.module+el9.8.0+24852+4534d062 rubygem-racc >= 1.8.1-35.module+el9.8.0+24852+4534d062 rubygem-rake >= 13.3.1-35.module+el9.8.0+24852+4534d062 rubygem-rbs >= 3.10.0-35.module+el9.8.0+24852+4534d062 rubygem-rdoc >= 7.0.4-35.module+el9.8.0+24852+4534d062 rubygem-rexml >= 3.4.4-35.module+el9.8.0+24852+4534d062 rubygem-rss >= 0.3.2-35.module+el9.8.0+24852+4534d062 rubygem-test-unit >= 3.7.5-35.module+el9.8.0+24852+4534d062 rubygem-typeprof >= 0.31.1-35.module+el9.8.0+24852+4534d062 rubygems >= 4.0.16-35.module+el9.8.0+24852+4534d062 rubygems-devel >= 4.0.16-35.module+el9.8.0+24852+4534d062	Patchnames: RHSA-2026:72286 (i686,x86_64) RHSA-2026:72484 (i686,x86_64) RHSA-2026:72485 (i686,x86_64)

---

SUSE Timeline for this CVE

CVE page created: Mon Sep 28 16:46:50 2026
CVE page last modified: Wed Oct 21 13:48:58 2026