Critical Denial of Service Vulnerability in ruby4.0 Package
Summary
RLSA-2026:72427: Important: ruby4.0 security update. Affects ruby4.0 versions < 0:4.0.6-37.el10_2. Fixed in 0:4.0.6-37.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web development and has a rich ecosystem of libraries and frameworks. The ruby4.0 package, specifically designed for Rocky Linux 10, provides essential tools for Ruby development. However, it is susceptible to a significant security flaw that can lead to denial of service due to uncontrolled memory growth when processing crafted DNS responses.
Vulnerability Detail
The vulnerability identified as CVE-2026-80212 affects the resolv gem within the ruby4.0 package. It allows attackers to exploit the system by sending specially crafted DNS responses that can cause uncontrolled memory growth, potentially leading to a denial of service. This issue arises from improper handling of DNS responses, which can overwhelm system resources and disrupt service availability. The CVSS score for this vulnerability is 7.5, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:4.0.6-37.el10_2
This is the first release that contains the fix.
sudo dnf update ruby4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of your application to untrusted DNS responses or implement rate limiting on DNS queries to mitigate the impact of this vulnerability until a patch is applied.
Conclusion
The ruby4.0 package has a critical vulnerability (CVE-2026-80212) that can lead to denial of service through crafted DNS responses. It is essential to update to the patched version to safeguard your applications. Implementing workarounds can provide temporary relief while you prepare for the update.
See every vulnerability recorded for ruby4.0 →
FAQ
CVE-2026-80212 is a security vulnerability in the ruby4.0 package that can lead to denial of service due to uncontrolled memory growth from crafted DNS responses.
If your application uses the ruby4.0 package, it may become unresponsive or crash if it processes malicious DNS responses, leading to service disruptions.
Implementing rate limiting on DNS queries and restricting access to untrusted DNS responses can help mitigate the risk until an update is applied.
Detailed information about CVE-2026-80212 can be found on the official CVE page and through security advisories from the Rocky Enterprise Software Foundation.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just a manifest file like package-lock.json, ensuring your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for ruby4.0.
