DNS Encoding Issue in Resolv Gem for Ruby

CVE-2026-80213

What is CVE-2026-80213?

A flaw has been identified within the Resolv gem for Ruby, impacting versions prior to 0.7.2. The vulnerability arises from the improper handling of DNS label lengths, where lengths exceeding the RFC 1035 standard are mishandled. Specifically, this issue allows for an attacker-controlled hostname to bypass validation checks by overwriting the DNS label length with an incorrect value. Consequently, the actual DNS query sent may resolve to a malicious domain instead of the intended one, as the restrictions on valid label lengths are circumvented. This can allow an attacker to manipulate DNS responses, leading to potential data exposure and exploitation of applications that rely on the affected gem.

References