Critical Security Update for Ruby Package: Denial of Service Vulnerability
Summary
ALSA-2026:72485: Important: ruby:3.3 security update. Affects ruby versions < 3.3.12-9.module_el9.8.0+320+13e2b195. Fixed in 3.3.12-9.module_el9.8.0+320+13e2b195. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language widely used for web development and system management tasks. It features a rich set of libraries and tools, making it a popular choice among developers. However, recent vulnerabilities have raised concerns regarding its security, particularly with the resolv gem, which is responsible for DNS resolution. This vulnerability can lead to uncontrolled memory growth, potentially causing Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability identified as CVE-2026-80212 affects the resolv gem in Ruby, allowing attackers to exploit crafted DNS responses. This can lead to uncontrolled memory growth, resulting in a Denial of Service condition where the application may become unresponsive or crash. The vulnerability stems from improper handling of DNS responses, which can be manipulated by malicious actors to consume excessive memory resources.
How To Fix
Minimum fixed version
3.3.12-9.module_el9.8.0+320+13e2b195
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the DNS responses processed by the application or implement rate limiting on DNS queries to mitigate the impact of this vulnerability until a full update can be applied.
Conclusion
The Ruby package has a critical vulnerability that can lead to Denial of Service attacks. It is crucial to update to the latest patched versions to safeguard your application. Temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for ruby →
FAQ
CVE-2026-80212 is a security vulnerability in the Ruby programming language's resolv gem that can lead to Denial of Service due to uncontrolled memory growth from crafted DNS responses.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to Denial of Service, causing the application to become unresponsive or crash due to excessive memory consumption.
You can update your Ruby packages using the command sudo dnf update ruby ruby-bundled-gems ... to ensure you have the latest patched versions.
Yes, you can limit the DNS responses processed by your application or implement rate limiting on DNS queries as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
