Threats Tagged 'cve-2026-80213'

A denial of service vulnerability (CVE-2026-80212) exists in the Ruby resolv gem used in Red Hat Hardened Images and related Ruby 4.0 packages. The vulnerability is caused by uncontrolled memory growth triggered by crafted DNS responses. Red Hat has issued updated RPM packages to address this issue. No known exploits are reported in the wild. The severity is assessed as high due to the potential impact of denial of service.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple ruby3.3 packages to address security vulnerabilities identified by CVE-2026-80212 and CVE-2026-80213. The update affects various architectures including aarch64 and x86_64. The advisory provides updated package versions to mitigate these vulnerabilities.

CVE-2026-80213 is a numeric truncation error in the Ruby resolv gem before version 0.7.2. The vulnerability arises because the DNS label length is written as a single octet without validating its range, allowing labels longer than 255 octets to be encoded incorrectly. This causes the wire format of DNS queries to differ from the intended domain name, potentially bypassing allowlist and egress checks. The issue can lead to recursive resolvers caching responses under attacker-controlled names and DNS logs recording misleading domain names.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to ruby3.4 and related packages. The advisory addresses multiple vulnerabilities including CVE-2026-54876. The update is a bug fix and enhancement release for these RPMs across multiple architectures such as aarch64 and x86_64. No detailed technical information about the vulnerabilities or exploits is provided in the advisory. The update is available and should be applied to affected systems.

This update includes the following RPMs: ruby4.0: * ruby4.0-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-bundled-gems-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-default-gems-4.0.6-37.2.hum1 (noarch) * ruby4.0-devel-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-doc-4.0.6-37.2.hum1 (noarch) * ruby4.0-libs-4.0.6-37.2.hum1 (aarch64, x86_64) * rubygem4.0-bigdecimal-4.0.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-bundler-4.0.16-37.2.hum1 (noarch) * rubygem4.0-devel-4.0.16-37.2.hum1 (noarch) * rubygem4.0-io-console-0.8.2-37.2.hum1 (aarch64, x86_64) * rubygem4.0-irb-1.16.0-37.2.hum1 (noarch) * rubygem4.0-json-2.18.0-37.2.hum1 (aarch64, x86_64) * rubygem4.0-minitest-6.0.0-37.2.hum1 (noarch) * rubygem4.0-power_assert-3.0.1-37.2.hum1 (noarch) * rubygem4.0-psych-5.3.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-racc-1.8.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-rake-13.3.1-37.2.hum1 (noarch) * rubygem4.0-rbs-3.10.0-37.2.hum1 (aarch64, x86_64) * rubygem4.0-rdoc-7.0.4-37.2.hum1 (noarch) * rubygem4.0-rexml-3.4.4-37.2.hum1 (noarch) * rubygem4.0-rss-0.3.2-37.2.hum1 (noarch) * rubygem4.0-rubygems-4.0.16-37.2.hum1 (noarch) * rubygem4.0-test-unit-3.7.5-37.2.hum1 (noarch) * rubygem4.0-typeprof-0.31.1-37.2.hum1 (noarch) * ruby4.0-4.0.6-37.2.hum1.src (src) Security Fix(es): ruby4.0: * CVE-2026-33210

This update includes the following RPMs: ruby4.0: * ruby4.0-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-bundled-gems-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-default-gems-4.0.6-37.2.hum1 (noarch) * ruby4.0-devel-4.0.6-37.2.hum1 (aarch64, x86_64) * ruby4.0-doc-4.0.6-37.2.hum1 (noarch) * ruby4.0-libs-4.0.6-37.2.hum1 (aarch64, x86_64) * rubygem4.0-bigdecimal-4.0.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-bundler-4.0.16-37.2.hum1 (noarch) * rubygem4.0-devel-4.0.16-37.2.hum1 (noarch) * rubygem4.0-io-console-0.8.2-37.2.hum1 (aarch64, x86_64) * rubygem4.0-irb-1.16.0-37.2.hum1 (noarch) * rubygem4.0-json-2.18.0-37.2.hum1 (aarch64, x86_64) * rubygem4.0-minitest-6.0.0-37.2.hum1 (noarch) * rubygem4.0-power_assert-3.0.1-37.2.hum1 (noarch) * rubygem4.0-psych-5.3.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-racc-1.8.1-37.2.hum1 (aarch64, x86_64) * rubygem4.0-rake-13.3.1-37.2.hum1 (noarch) * rubygem4.0-rbs-3.10.0-37.2.hum1 (aarch64, x86_64) * rubygem4.0-rdoc-7.0.4-37.2.hum1 (noarch) * rubygem4.0-rexml-3.4.4-37.2.hum1 (noarch) * rubygem4.0-rss-0.3.2-37.2.hum1 (noarch) * rubygem4.0-rubygems-4.0.16-37.2.hum1 (noarch) * rubygem4.0-test-unit-3.7.5-37.2.hum1 (noarch) * rubygem4.0-typeprof-0.31.1-37.2.hum1 (noarch) * ruby4.0-4.0.6-37.2.hum1.src (src) Security Fix(es): ruby4.0: * CVE-2026-33210