# Security advisories: CVE-2026-80212 and CVE-2026-80213

DevFeed: [Security advisories: CVE-2026-80212 and CVE-2026-80213](<https://devfeed.tech/articles/security-advisories-cve-2026-80212-and-cve-2026-80213-19157.md>)

Original publisher: [Read original article](<https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/>)

Published: 2026-08-27T00:00:00Z

Content type: news

Language: en

Sources: [Ruby-lang](<https://devfeed.tech/sources/ruby-lang.md>)

Topics: [Ruby](<https://devfeed.tech/topics/ruby.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Network](<https://devfeed.tech/topics/network.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [cve](<https://devfeed.tech/tags/cve.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [dns](<https://devfeed.tech/tags/dns.md>), [end-of-life](<https://devfeed.tech/tags/end-of-life.md>), [memory](<https://devfeed.tech/tags/memory.md>), [network](<https://devfeed.tech/tags/network.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [security](<https://devfeed.tech/tags/security.md>), [update](<https://devfeed.tech/tags/update.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Ruby's bundled resolv gem has two vulnerabilities: malicious DNS responses can cause unbounded memory exhaustion, and specially crafted overlong hostnames can bypass hostname validation. The advisory identifies affected versions and recommends updating the gem.

## Source excerpt

Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of memory and the service stops. CVE-2026-80213: Hostname validation bypass An application that checks a hostname against an allow list or an SSRF filter and then resolves it can be made to look up a domain other than the one it checked. The string that passes validation and the name that reaches the network are not the same, so the connection can end up at a host the application never approved. This requires a hostname that exceeds the DNS length limits, so validation that rejects names longer than 255 octets, or labels longer than 63 octets, is not affected. Affected versions resolv gem 0.4.0 through 0.7.1 resolv gem 0.3.1 and earlier The version bundled with Ruby differs per series: Ruby 4.0 ships resolv 0.7.0, Ruby 3.4 ships 0.7.1, and Ruby 3.3 ships 0.3.1. What to check Only code that resolves names through this gem is affected. Ordinary socket connections, including Net::HTTP and anything built on TCPSocket, use the operating system resolver and are not. Net::HTTP does load the gem, but only for its IP address regular expressions, so a loaded gem is not by itself a sign of exposure. An application reaches the affected code by calling Resolv itself, by loading resolv-replace, which routes all socket name resolution through the gem, or through a dependency that resolves names this way. Check your dependencies as well as your own code. Recommended action Update the resolv gem to 0