Red Hat Ruby Update Fixes CVE-2026-80212 on RHEL 10
Tech GuruQuick Answer
CVE-2026-80212 can exhaust memory in Ruby's resolv DNS library when an attacker controls or spoofs the responses it processes. RHSA-2026:72785 lists ruby 0:3.3.12-15.el10_2 for RHEL 10.2 AppStream. Review applications using resolv, install the matching supported package, and validate their normal DNS-dependent workflows.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory the Ruby packages and applications using resolv, confirm Red Hat's update for the installed RHEL branch, and validate those applications after deployment. Keep the package transaction, resulting build, and recovery record.
Evidence status, 2026-10-02 UTC: Red Hat's CVE record and structured erratum (CSAF) confirm the impact and fixed RPM mapping below. Package rollout and regression tests have not been performed here. Confirm your repository and subscription before deployment.
Scope And Authority
| Product scope | Ruby on RHEL 10.2 |
|---|---|
| Advisory | RHSA-2026:72785 |
| CVE | CVE-2026-80212 |
| Authoritative release date | CSAF initial-release timestamp: 2026-10-02 11:21:12 UTC. A Red Hat Bugzilla comment links this erratum on September 28; the publication chronology is not reconciled here. |
| Authority revision date | CSAF last-updated entry: 2026-10-02 11:21:12 UTC; document generated 17:35:20 UTC. These are source-tracking timestamps, not installation or test dates. |
| Affected versions | RHEL 10.2 AppStream packages covered by this erratum; compare the installed RPM, including epoch and architecture, with the fixed mapping. Do not transfer this build to another stream. |
| Fixed version | ruby 0:3.3.12-15.el10_2 in RHEL 10.2 AppStream; the prefix before the colon is the RPM epoch. |
| CVSS base score | 7.5 (official CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | This notice has no verified exploitation statement for this erratum. Do not infer either exploitation or its absence from the score. |
What Changed
Red Hat describes CVE-2026-80212 as a flaw in the resolv gem. Crafted DNS responses can create objects that are never reclaimed, causing continuing memory growth and denial of service. The attacker must be able to supply or spoof those responses. The separate CSAF erratum supplies the RPM mapping; the CVE description alone does not establish a package fix.
What To Validate Now
- Inventory. Record the RHEL release, Ruby package build, architecture, repository, application owner, and applications that use resolv. Identify which running workloads need attention during the update.
- Establish applicability. Match the installed Ruby package and RHEL branch to RHSA-2026:72785 and your supported Red Hat repository. Do not use another branch's build or a separately installed runtime as proof that this package is fixed.
- Remediate. Install the applicable ruby 0:3.3.12-15.el10_2 package or supported superseding update from the RHEL 10.2 AppStream repository. Separately installed Ruby runtimes and container images require their own fix mapping; no live-patch route is established here.
- Validate. Record the installed Ruby package build. Restart affected workloads where required and test their normal DNS-dependent application workflows, watching for unexpected memory growth or failures. Check recovery procedures and record exceptions; TechGeeks has not performed these tests.
Operational Cautions
Confirm subscription access, branch support, and package compatibility before deployment. Preserve prior packages and recovery records. A rollback may restore vulnerable software and is not a security fix. Container deployments need their own verified image and package mapping; no image digest or live-patch procedure is established here. Severity alone does not prove exploitation.
Evidence To Retain
- Asset and owner identifiers, exact product and release, architecture or platform, relevant configuration, and the applicability decision.
- UTC timestamps and vendor advisory revision, change approval, before-and-after versions, and installer or package-manager output.
- Relevant logs, validation results, exceptions, compensating controls, and recovery or rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
