Security advisories: CVE-2026-80212 and CVE-2026-80213

Two CVEs in the resolv gem bundled with Ruby: memory exhaustion from malicious DNS responses, affecting any app that resolves attacker-influenced hostnames. Upgrade the gem rather than waiting for a Ruby release.

Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213 . We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns re...