Ruby resolv gem CVE-2026-80213

Exploitation requires that an attacker control or inject a hostname string that the vulnerable application passes to Resolv::DNS for resolution without prior per-label length validation - for example, via a user-supplied URL, webhook target, SSRF-triggering parameter, redirect destination, or externally-sourced configuration value. The application must be running a resolv gem version in the affected ranges (0.4.0-<0.7.2 or 0-<0.3.2). The attacker must craft a DNS label exceeding 63 octets with a length whose single-byte truncation lands in a range useful for exploitation (particularly 0xC0-0xFF to trigger compression pointer misparse). The CVSS AC:H rating reflects that this combination - attacker-controlled hostname reaching the DNS encoder without length sanitization, in an application using DNS checks as a security control - is not universally present. No authentication is required of the attacker (PR:N per CVSS vector). Exploitation is limited by the need for the application to both accept attacker-supplied hostnames and rely on DNS-layer controls for security decisions; applications that do not resolve externally-controlled names are not affected.

The CVSS 3.1 base score of 4.0 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N is consistent with the actual threat model. AC:H is accurate: exploitation requires the attacker to control or inject a hostname that the vulnerable application passes to Resolv::DNS for resolution without prior length sanitization, a condition that limits the attack surface to applications accepting user-supplied or externally-sourced hostname input as part of a security-relevant control path. The Scope:Changed (S:C) rating correctly captures that the consequences extend beyond the vulnerable process - the recursive resolver caches entries under the attacker's chosen name, and DNS audit logs record that name rather than the intended one, degrading security monitoring integrity. Integrity impact is Low (I:L) as the primary harm is allowlist and egress filter bypass rather than arbitrary data corruption. KEV status is not confirmed, EPSS is not provided in source data, and no POC has been identified - the real-world exploitation risk is therefore unquantified but structurally higher for applications that rely on DNS-based egress filtering or hostname allowlists as a security boundary. The CVSS score may understate risk for such security-critical architectures.

An attacker submits a webhook URL or SSRF-triggering parameter containing a crafted hostname whose primary label exceeds 63 octets with a total byte length that, when truncated to a single octet, falls in the 0xC0-0xFF compression-pointer range. The application validates the full hostname string against an allowlist (e.g., asserting it ends with .trusted.example.com) and passes it to Resolv::DNS - the validating suffix appears in the string but never reaches the wire, where the truncated length byte causes a conforming resolver to follow a compression pointer to a different, attacker-controlled domain. The recursive resolver resolves and caches the attacker's chosen domain, returning a response under that name while DNS logs record the attacker's domain rather than the intended one, defeating both the allowlist check and downstream audit correlation.