CVE-2026-80212 (UNKNOWN): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-80212](https://avd.aquasec.com/nvd/cve-2026-80212) | `UNKNOWN` | `resolv` | `0.7.0` | `~> 0.3.2, >= 0.7.2` | `2026-08-27T17:20:50.88Z` | `2026-08-30T10:18:58.876659704Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/ruby:latest` | `public.ecr.aws/lambda/ruby@sha256:5da74922095128746fcf77ffc5d182c1dc516a6476ad3f93c14741e60d40fd9b` |
| `public.ecr.aws/lambda/ruby:4.0` | `public.ecr.aws/lambda/ruby@sha256:5da74922095128746fcf77ffc5d182c1dc516a6476ad3f93c14741e60d40fd9b` |
| `public.ecr.aws/lambda/ruby:3.4` | `public.ecr.aws/lambda/ruby@sha256:f800eeccd3ab5f91733e134395a614eb462f33d9563b97481e122f91faac5dad` |
| `public.ecr.aws/lambda/ruby:3.3` | `public.ecr.aws/lambda/ruby@sha256:fa243b9c09faed0430521b19767b02bd7a06c0cad85cc26fe432d9cfee4cbfd7` |

---

## Description

> An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.

---

### Remediation Steps
- Update the affected package `resolv` from version `0.7.0` to `~> 0.3.2, >= 0.7.2`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Locate the build definitions for the affected Lambda Ruby images and trace how the resolv package is installed or pinned. Rebuild the affected tags with resolv at least 0.7.2, then verify the resulting image versions and rerun the vulnerability scan.

Written by the indexing model from the issue text.