Issue #22317 has been updated by hsbt (Hiroshi SHIBATA). Status changed from Open to Closed The vendored copy is not affected. RubyGems never used it as a resolver. The only reference was `Resolv::IPv4::Regex` and `Resolv::IPv6::Regex` in the vendored `net/http`, which decide whether an address may be sent as a Server Name Indication. `Resolv::DNS` was never instantiated, so the decoder paths that CVE-2026-80212 and CVE-2026-80213 fix were unreachable. I removed it anyway in https://github.com/ruby/rubygems/pull/9877. It will be released in the RubyGems 4.0 series and merged into Ruby 4.0 in due course. ---------------------------------------- Bug #22317: Also update lib/rubygems/vendor/resolv/lib/resolv.rb for CVE issue?? https://bugs.ruby-lang.org/issues/22317#change-119032 * Author: mtasaka (Mamoru TASAKA) * Status: Closed * ruby -v: 4.0.7 * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Recently two CVE security issues are reported against resolv gem, and looks like fixed resolv 0.7.2 was pushed into ruby_4_0 branch: https://github.com/ruby/ruby/commit/2da9a6ef3f423fb85acfd5c41150bb22cdeb14ef which updates lib/resolv.rb in ruby tree, which is finally included in released ruby 4.0.7 tarball. However, there is another "resolv.rb" under lib/rubygems/vendor/resolv/lib/ in ruby 4.0.7 "tarball" and it says the version is still 0.7.0, so looks like this is still affected by CVE issue. https://github.com/ruby/ruby/blob/v4.0.7/lib/rubygems/vendor/resolv/lib/reso... So propably the above file also needs updating?? -- https://bugs.ruby-lang.org/