Critical Denial of Service Vulnerability in Ruby Package - CVE-2026-80212
Summary
RLSA-2026:72785: Important: ruby security update. Affects ruby versions < 0:3.3.12-15.el10_2. Fixed in 0:3.3.12-15.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language widely used for web development and system management tasks. It features a rich set of libraries and tools, making it a popular choice among developers. However, it is susceptible to vulnerabilities, such as the one identified in the resolv gem, which can lead to severe security issues.
Vulnerability Detail
The vulnerability identified as CVE-2026-80212 affects the resolv gem in Ruby, allowing for a Denial of Service (DoS) attack through uncontrolled memory growth when processing crafted DNS responses. This can lead to application crashes or unresponsive behavior, severely impacting the availability of services relying on Ruby applications.
How To Fix
Minimum fixed version
0:3.3.12-15.el10_2
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the processing of DNS responses by implementing stricter validation checks in your application code. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The CVE-2026-80212 vulnerability in the Ruby package poses a significant risk of Denial of Service due to uncontrolled memory growth from crafted DNS responses. It is crucial to update to the patched version to ensure the security and availability of your applications.
See every vulnerability recorded for ruby →
FAQ
CVE-2026-80212 is a vulnerability in the Ruby programming language's resolv gem that can lead to Denial of Service due to uncontrolled memory growth from crafted DNS responses.
If your application uses the affected version of Ruby, it may become unresponsive or crash when processing malicious DNS responses, impacting service availability.
You should update your Ruby package to the patched version (0:3.3.12-15.el10_2 or later) to mitigate the vulnerability.
Yes, you can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application at Vulert Scanner without signing up.
The CVSS score for CVE-2026-80212 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
