The vulnerability arises from an unchecked DNS label length field in the Ruby Resolv gem before version 0.7.2. When a label longer than 255 octets is encoded, the length is stored modulo 256 while the label data remains unchanged. This numeric truncation allows an attacker to inject values that are interpreted by DNS parsers as compression pointers or padding, causing the encoded DNS query to carry a different, attacker‑controlled domain name than the one supplied by the application. As a result, applications that perform allowlist or egress validation on the hostname being resolved can be tricked into sending queries for domains the attacker chooses, and the recursive resolver caches the response under that name. DNS logs will record the attacker‑chosen domain instead of the intended one, facilitating covert exfiltration or denial of service.

This issue affects the Ruby Resolv gem. Any installation of resolv prior to version 0.7.2 is vulnerable. Systems running Ruby applications that depend on this gem, such as web servers or network utilities that resolve hostnames, are at risk unless they upgrade to 0.7.2 or newer.

The vulnerability is primarily exploitable when the application accepts arbitrary hostnames from untrusted sources. An attacker can craft a hostname that contains byte values designed to abuse the length field, causing the resolver to send a DNS query for a domain of the attacker’s choosing. Because the application treats the padding added to satisfy length constraints as invisible, the allowlist and egress filters are bypassed. The recursive resolver then caches the mapping, and DNS logs will show the attacker’s name, potentially aiding other malicious actions. The CVSS score of 4 indicates low severity, and the EPSS score of 0.0035 indicates a very low probability of exploitation, while the lack of a KEV listing suggests limited known exploitation at this time. The likely attack vector is network‑level DNS query manipulation triggered by controlled hostname input.