The resolv gem creates a new class for every unknown DNS record type or service parameter key it encounters while decoding a response. Each generated class is permanently registered as a constant and stored in a lookup hash, keeping it alive even after the response is discarded. An attacker who controls DNS responses can supply thousands of unknown types, causing the process to consume tens of megabytes of memory per response and accumulate memory usage without release. This leads to resource exhaustion and can bring the Ruby process to a halt, presenting a denial-of-service threat. The weakness is a classic resource exhaustion issue (CWE‑770).

This vulnerability affects the Ruby standard library gem “resolv” in all versions prior to 0.7.2. Because the gem is included by default in a Ruby installation, any Ruby application that processes DNS responses using Resolv::DNS::Message.decode on untrusted data is affected. The issue is vendor‑agnostic but applies to all Ruby deployments that have the default resolv gem available.

The CVSS score of 7.5 places this vulnerability in the high severity range. While no EPSS score is reported, the attack surface is significant: an attacker who can influence DNS traffic—through a spoofed responder, a hijacked upstream server, or by directly injecting responses into a Ruby process—can trigger the exploit. The vulnerability is listed outside of the CISA KEV catalog, and no indication of active exploitation is known. The class generation has no built‑in garbage collection protection, making repeated crafted responses a reliable way to exhaust memory. The security risk is therefore high for any Ruby environment that accepts untrusted DNS data and does not constrain the size or content of DNS responses.