Ruby resolv gem EUVD-2026-67138

Exploitation requires the attacker to control DNS responses returned to the target Ruby application - specifically through one of: a spoofed DNS response delivered via an on-path network position, a malicious DNS server configured as the application's upstream resolver, or a hijacked legitimate upstream DNS server. No special application configuration is required; any code path calling Resolv::DNS::Message.decode (including standard Ruby DNS lookup utilities) is affected as long as the response content can be attacker-influenced. Exploitation is bounded by the prerequisite of DNS response control, which prevents trivial opportunistic mass exploitation but does not protect applications resolving external or user-supplied hostnames. DNSSEC deployment at the resolver reduces the viability of spoofed-response attacks but does not address the compromised-resolver scenario. The vulnerability is present in all Ruby installations using resolv prior to 0.7.2, with no platform or version carve-outs noted in the advisory.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes a remotely exploitable denial-of-service with no authentication or user interaction requirement. The practical exploitation barrier is the need to influence DNS responses reaching the target - via DNS cache poisoning, an on-path spoofing position, or a malicious or hijacked upstream resolver - which is a meaningful prerequisite that AC:L arguably understates. EPSS data is absent from the available intelligence, preventing probabilistic exploitation likelihood assessment; the CVE does not appear in CISA KEV and no public exploit code has been identified, indicating active exploitation is not yet confirmed. Despite these moderating factors, the real-world risk is substantial: the memory accumulation is mechanically permanent and unbounded - the Ruby runtime's GC invariants guarantee classes anchored by constants are never collected - meaning even a modest volume of crafted responses causes irreversible process memory growth. The threat model is most relevant for Ruby applications that resolve external or attacker-influenced hostnames, including applications that follow redirects, resolve user-supplied domains, or use resolv as part of a service-discovery or email-handling flow. The inability to recover memory without a process restart means that sustained low-rate exploitation can degrade service over time rather than requiring a single large-volume burst.

An attacker who has compromised or is impersonating an upstream DNS resolver sends a series of DNS responses to a target Ruby application, each containing tens of thousands of resource records with distinct unknown (type, class) pairs. Each decoded response permanently registers hundreds of new Ruby class constants in the resolv library's ClassHash, growing the process heap by tens of megabytes per response. After repeated exchanges - automated and requiring no user interaction - the Ruby process exhausts available memory and terminates, denying service. No public exploit code exists at time of analysis, but the attack is mechanically straightforward for any actor with DNS response control.