CVE-2026-80212 (UNKNOWN): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-80212	UNKNOWN	resolv	0.7.0	~> 0.3.2, >= 0.7.2	2026-08-27T17:20:50.88Z	2026-08-30T10:18:58.876659704Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:5da74922095128746fcf77ffc5d182c1dc516a6476ad3f93c14741e60d40fd9b
public.ecr.aws/lambda/ruby:4.0	public.ecr.aws/lambda/ruby@sha256:5da74922095128746fcf77ffc5d182c1dc516a6476ad3f93c14741e60d40fd9b
public.ecr.aws/lambda/ruby:3.4	public.ecr.aws/lambda/ruby@sha256:f800eeccd3ab5f91733e134395a614eb462f33d9563b97481e122f91faac5dad
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:fa243b9c09faed0430521b19767b02bd7a06c0cad85cc26fe432d9cfee4cbfd7

---

Description

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.

---

Remediation Steps

• Update the affected package resolv from version 0.7.0 to ~> 0.3.2, >= 0.7.2.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.