An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a label to 63 octets, and the two high bits of the length octet are reserved for compression pointers. put_string packed the length with put_pack("C", d.length) and put_label used it for labels, and thus any value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the 0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname suffix that the application validates against an allowlist becomes padding that never appears on the wire, and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the attacker's name, and DNS logs record that name rather than the one the application asked for. A label length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read as the start of a compression pointer, with the following attacker-controlled byte as the offset.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789644305 advisory.

  - An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,     Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for     each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while     decoding a response. Each generated class was permanently registered both as a constant on Resource (or     SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained     reachable through that constant after the response was discarded. Type and class are each 16-bit values,     and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream     DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few     hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by     tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage     collection, because the constant keeps each class alive. Any code path that calls     Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and     thus this is reachable from a plain Ruby installation without any additional dependency. (CVE-2026-80212)

  - An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS     label's length into a single octet without checking its range. A label longer than 255 octets had its     length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire     described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a     label to 63 octets, and the two high bits of the length octet are reserved for compression pointers.
    put_string packed the length with put_pack(C, d.length) and put_label used it for labels, and thus any     value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the     0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and     thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an     attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname     suffix that the application validates against an allowlist becomes padding that never appears on the wire,     and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the     attacker's name, and DNS logs record that name rather than the one the application asked for. A label     length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read     as the start of a compression pointer, with the following attacker-controlled byte as the offset.
    (CVE-2026-80213)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789644305 advisory.

  - An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,     Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for     each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while     decoding a response. Each generated class was permanently registered both as a constant on Resource (or     SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained     reachable through that constant after the response was discarded. Type and class are each 16-bit values,     and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream     DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few     hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by     tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage     collection, because the constant keeps each class alive. Any code path that calls     Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and     thus this is reachable from a plain Ruby installation without any additional dependency. (CVE-2026-80212)

  - An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS     label's length into a single octet without checking its range. A label longer than 255 octets had its     length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire     described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a     label to 63 octets, and the two high bits of the length octet are reserved for compression pointers.
    put_string packed the length with put_pack(C, d.length) and put_label used it for labels, and thus any     value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the     0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and     thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an     attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname     suffix that the application validates against an allowlist becomes padding that never appears on the wire,     and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the     attacker's name, and DNS logs record that name rather than the one the application asked for. A label     length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read     as the start of a compression pointer, with the following attacker-controlled byte as the offset.
    (CVE-2026-80213)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789392152 advisory.

  - An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,     Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for     each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while     decoding a response. Each generated class was permanently registered both as a constant on Resource (or     SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained     reachable through that constant after the response was discarded. Type and class are each 16-bit values,     and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream     DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few     hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by     tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage     collection, because the constant keeps each class alive. Any code path that calls     Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and     thus this is reachable from a plain Ruby installation without any additional dependency. (CVE-2026-80212)

  - An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS     label's length into a single octet without checking its range. A label longer than 255 octets had its     length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire     described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a     label to 63 octets, and the two high bits of the length octet are reserved for compression pointers.
    put_string packed the length with put_pack(C, d.length) and put_label used it for labels, and thus any     value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the     0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and     thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an     attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname     suffix that the application validates against an allowlist becomes padding that never appears on the wire,     and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the     attacker's name, and DNS logs record that name rather than the one the application asked for. A label     length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read     as the start of a compression pointer, with the following attacker-controlled byte as the offset.
    (CVE-2026-80213)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b3bccd6a30 advisory.

    This rpm updates included resolv gem to 0.7.2 to resolve CVE security issues.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9831a751e2 advisory.

    Update rubygems to 4.0.20. Additionally, several security issues were found in resolv gem bundled in     rubygems. This update resolves these issues by updating resolv to 0.7.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-da06bdeb38 advisory.

    This rpm updates included resolv gem to 0.7.2 to resolve CVE security issues.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2857104379 advisory.

    Update rubygems to 4.0.20. Additionally, several security issues were found in resolv gem bundled in     rubygems. This update resolves these issues by updating resolv to 0.7.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ab0c751524 advisory.

    This rpm updates included resolv gem to 0.7.2 to resolve CVE security issues.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2145 advisory.

    An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,     Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for     each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while     decoding a response. Each generated class was permanently registered both as a constant on Resource (or     SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained     reachable through that constant after the response was discarded. Type and class are each 16-bit values,     and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream     DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few     hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by     tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage     collection, because the constant keeps each class alive. Any code path that calls     Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and     thus this is reachable from a plain Ruby installation without any additional dependency. (CVE-2026-80212)

    An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS     label's length into a single octet without checking its range. A label longer than 255 octets had its     length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire     described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a     label to 63 octets, and the two high bits of the length octet are reserved for compression pointers.
    put_string packed the length with put_pack(C, d.length) and put_label used it for labels, and thus any     value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the     0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and     thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an     attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname     suffix that the application validates against an allowlist becomes padding that never appears on the wire,     and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the     attacker's name, and DNS logs record that name rather than the one the application asked for. A label     length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read     as the start of a compression pointer, with the following attacker-controlled byte as the offset.
    (CVE-2026-80213)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2144 advisory.

    An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class,     Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for     each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while     decoding a response. Each generated class was permanently registered both as a constant on Resource (or     SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained     reachable through that constant after the response was discarded. Type and class are each 16-bit values,     and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream     DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few     hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by     tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage     collection, because the constant keeps each class alive. Any code path that calls     Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and     thus this is reachable from a plain Ruby installation without any additional dependency. (CVE-2026-80212)

    An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS     label's length into a single octet without checking its range. A label longer than 255 octets had its     length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire     described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a     label to 63 octets, and the two high bits of the length octet are reserved for compression pointers.
    put_string packed the length with put_pack(C, d.length) and put_label used it for labels, and thus any     value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the     0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and     thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an     attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname     suffix that the application validates against an allowlist becomes padding that never appears on the wire,     and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the     attacker's name, and DNS logs record that name rather than the one the application asked for. A label     length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read     as the start of a compression pointer, with the following attacker-controlled byte as the offset.
    (CVE-2026-80213)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbf03424ec advisory.

    Update resolv gem in ruby.src to resolve security issues.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c77b963cc9 advisory.

    Automatic update for rubygems-4.0.20-1.fc46.

    ##### **Changelog**

    ```
    * Thu Sep  3 2026 Mamoru TASAKA <mtasaka@fedoraproject.org> - 4.0.20-1
    - Update to RubyGems 4.0.20
    - Backport ruby upstream patch to update resolv to 0.7.2
    - Resolves: CVE-2026-80212 (rhbz#2527309)
    - Resolves: CVE-2026-80213 (rhbz#2527311)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS     label's length into a single octet without checking its range. A label longer than 255 octets had its     length stored modulo 256 but the label data was written unchanged, and thus the bytes on the wire     described a different name than the one the application asked to encode. RFC 1035 section 2.3.4 limits a     label to 63 octets, and the two high bits of the length octet are reserved for compression pointers.
    put_string packed the length with put_pack(C, d.length) and put_label used it for labels, and thus any     value from 0 to 255 could end up as a label length octet, including the reserved 0x40-0xBF range and the     0xC0-0xFF pointer range. Resolv::DNS::Name.create did not check per-label or total name length either, and     thus an attacker-controlled hostname reached the encoder unchanged. An application that resolves an     attacker-controlled hostname sends a query whose wire bytes name a domain the attacker chose. A hostname     suffix that the application validates against an allowlist becomes padding that never appears on the wire,     and thus allowlist and egress checks can be bypassed. The recursive resolver caches the response under the     attacker's name, and DNS logs record that name rather than the one the application asked for. A label     length whose low octet lands in the 0xC0-0xFF range produces a length octet that conforming parsers read     as the start of a compression pointer, with the following attacker-controlled byte as the offset.
    (CVE-2026-80213)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
360299	Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789644305)	Nessus	Rocky Linux Local Security Checks	Local	medium
360040	AlmaLinux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789644305)	Nessus	Alma Linux Local Security Checks	Local	medium
352872	AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789392152)	Nessus	Alma Linux Local Security Checks	Local	medium
348258	Fedora 43 : ruby (2026-b3bccd6a30)	Nessus	Fedora Local Security Checks	Local	medium
346023	Fedora 45 : rubygems (2026-9831a751e2)	Nessus	Fedora Local Security Checks	Local	medium
346022	Fedora 44 : ruby (2026-da06bdeb38)	Nessus	Fedora Local Security Checks	Local	medium
346020	Fedora 44 : rubygems (2026-2857104379)	Nessus	Fedora Local Security Checks	Local	medium
346013	Fedora 45 : ruby (2026-ab0c751524)	Nessus	Fedora Local Security Checks	Local	medium
345810	Amazon Linux 2023 : ruby3.4, ruby3.4-bundled-gems, ruby3.4-default-gems (ALAS2023-2026-2145)	Nessus	Amazon Linux Local Security Checks	Local	medium
345799	Amazon Linux 2023 : ruby4.0, ruby4.0-bundled-gems, ruby4.0-default-gems (ALAS2023-2026-2144)	Nessus	Amazon Linux Local Security Checks	Local	medium
344567	Fedora 46 : ruby (2026-fbf03424ec)	Nessus	Fedora Local Security Checks	Local	medium
344566	Fedora 46 : rubygems (2026-c77b963cc9)	Nessus	Fedora Local Security Checks	Local	medium
342194	Linux Distros Unpatched Vulnerability : CVE-2026-80213	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-80213

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium