CVE-2026-80212: CWE-770 Allocation of Resources Without Limits or Throttling in Ruby resolv

The vulnerability in Ruby's resolv gem (prior to 0.7.2) arises from the dynamic generation and permanent registration of new classes for each unknown DNS resource record (type, class) pair or unknown SvcParamKey encountered during DNS response decoding. Since type and class are 16-bit values, an attacker controlling DNS responses can craft up to approximately 2^32 distinct pairs, causing the process memory to grow unboundedly as these classes remain reachable and are not garbage collected. This leads to resource exhaustion and potential denial of service. The flaw affects all code paths invoking Resolv::DNS::Message.decode on attacker-influenced DNS responses. The gem is a default Ruby component, so no additional dependencies are required to be vulnerable.

An attacker capable of influencing DNS responses can cause unbounded memory growth in applications using the vulnerable resolv gem by triggering the creation of numerous unique classes that are never garbage collected. This can lead to denial of service through memory exhaustion. There is no direct impact on confidentiality or integrity, but availability is significantly affected.

No official fix or patch is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted DNS responses with Resolv::DNS::Message.decode or implement external controls to limit exposure to attacker-controlled DNS data.