A memory exhaustion vulnerability was discovered in the Ruby resolv gem before version 0.7.2. The affected functions generate a new class for each unknown DNS resource record type/class pair encountered during response decoding, permanently registering each class as a constant and in a class-lookup hash. Since type and class are each 16-bit values, an attacker controlling DNS responses has approximately 2^32 distinct pairs available to exploit. A single crafted response of a few hundred kilobytes can permanently grow process memory by tens of megabytes, and repeated responses accumulate without bound as garbage collection cannot reclaim the memory due to persistent constant references. Any code path invoking Resolv::DNS::Message.decode on attacker-influenced DNS responses is vulnerable. Since resolv is a default Ruby gem, this vulnerability is exploitable from a plain Ruby installation without additional dependencies, making the attack surface broad. Exploitation requires an attacker to control DNS responses via response spoofing or a malicious/hijacked upstream DNS server.
