Resolv
Monthly
DNS label length truncation in the Ruby resolv gem (versions before 0.7.2 and before 0.3.2) enables attacker-controlled hostnames to produce wire-format DNS queries naming a domain the attacker chose rather than the one the application intended. The flaw allows hostname allowlists and DNS egress controls to be silently bypassed - the validated string appears legitimate but the bytes transmitted to the recursive resolver describe a different name. No public exploit code has been identified at time of analysis, but the Scope:Changed CVSS rating reflects real spillover impact on DNS resolvers and audit logs beyond the vulnerable application itself.
Unbounded memory exhaustion in Ruby's resolv gem (before 0.7.2) allows an attacker controlling DNS responses to permanently grow a target process's memory without limit, eventually crashing the service. The root cause is that Resolv::DNS::Resource.get_class and related methods register a new Ruby class as a constant for each unknown DNS resource record type/class pair encountered, preventing garbage collection for the lifetime of the process. Because resolv is a default Ruby gem requiring no installation step, any plain Ruby installation performing DNS resolution - web services, workers, CLI tools - is exposed without opt-in configuration, and no public exploit has been identified at time of analysis.
DNS label length truncation in the Ruby resolv gem (versions before 0.7.2 and before 0.3.2) enables attacker-controlled hostnames to produce wire-format DNS queries naming a domain the attacker chose rather than the one the application intended. The flaw allows hostname allowlists and DNS egress controls to be silently bypassed - the validated string appears legitimate but the bytes transmitted to the recursive resolver describe a different name. No public exploit code has been identified at time of analysis, but the Scope:Changed CVSS rating reflects real spillover impact on DNS resolvers and audit logs beyond the vulnerable application itself.
Unbounded memory exhaustion in Ruby's resolv gem (before 0.7.2) allows an attacker controlling DNS responses to permanently grow a target process's memory without limit, eventually crashing the service. The root cause is that Resolv::DNS::Resource.get_class and related methods register a new Ruby class as a constant for each unknown DNS resource record type/class pair encountered, preventing garbage collection for the lifetime of the process. Because resolv is a default Ruby gem requiring no installation step, any plain Ruby installation performing DNS resolution - web services, workers, CLI tools - is exposed without opt-in configuration, and no public exploit has been identified at time of analysis.