CVE-2026-80213: CWE-197 Numeric Truncation Error in Ruby resolv

The Ruby resolv gem's DNS message encoder writes a DNS label's length into a single octet without range checking, allowing labels longer than 255 octets to be encoded with truncated length values modulo 256. This violates RFC 1035, which limits label length to 63 octets and reserves high bits for compression pointers. An attacker-controlled hostname can cause the encoded DNS query to differ from the requested name, enabling bypass of allowlist and egress validations. The recursive resolver caches responses under the attacker's chosen name, and DNS logs reflect this manipulated name. The vulnerability affects resolv versions before 0.7.2, including version 0.4.0 explicitly noted.

The vulnerability allows an attacker to craft DNS queries that differ on the wire from the application-intended domain name, potentially bypassing hostname allowlists and egress filtering. This can cause recursive DNS resolvers to cache and respond with manipulated domain names, misleading DNS logs and possibly affecting downstream security controls. The impact is limited to information integrity and validation bypass, with no direct confidentiality or availability impact reported.

No official fix or patch is currently confirmed for this vulnerability. Users should monitor the Ruby resolv gem releases for updates addressing this issue. Until a patch is available, applications should avoid resolving attacker-controlled hostnames or implement additional validation outside of the resolv gem to enforce DNS label length constraints according to RFC 1035.