Skip to content

Resolve resolv CVE-2026-80212 and CVE-2026-80213 #1160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eanders merged 1 commit into from
Sep 8, 2026
Merged

Resolve resolv CVE-2026-80212 and CVE-2026-80213 #1160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ gem 'rexml', '>= 3.4.2' # CVE-2025-58767, note this is bundled with ruby, and mu
gem 'json', '>= 2.19.2' # CVE-2026-33210, note this is bundled with ruby, and must be explicitly pinned
gem 'openssl', '>=3.3.1' # override the default ruby version of openssl https://github.com/ruby/openssl/issues/949#issuecomment-3370358680

gem 'resolv', '>= 0.7.2' # CVE-2026-80212 and CVE-2026-80213

# No longer default gems
gem 'irb'
gem 'reline'
Expand Down
3 changes: 3 additions & 0 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,6 +566,7 @@ GEM
io-console (~> 0.5)
request_store (1.7.0)
rack (>= 1.4)
resolv (0.7.2)
responders (3.2.0)
actionpack (>= 7.0)
railties (>= 7.0)
Expand Down Expand Up @@ -843,6 +844,7 @@ DEPENDENCIES
redcarpet
redis
reline
resolv (>= 0.7.2)
responders
rexml (>= 3.4.2)
roda
Expand Down Expand Up @@ -1092,6 +1094,7 @@ CHECKSUMS
regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb
reline (0.7.0) sha256=5b012d8e55dbf9d450f12bde2cf7d15ff546ae80b3f8f3b30e570d431815583d
request_store (1.7.0) sha256=e1b75d5346a315f452242a68c937ef8e48b215b9453a77a6c0acdca2934c88cb
resolv (0.7.2) sha256=626d044d975ab2daac759bf898416f1b51e2cb8dcd6727c2b5b5b28b97ead2e1
responders (3.2.0) sha256=89c2d6ac0ae16f6458a11524cae4a8efdceba1a3baea164d28ee9046bd3df55a
rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
roda (3.102.0) sha256=b2156fff6d2b1b52bfac39e4ccde0d820a26594f069c3d9e99cc0853f7ee7dcc
Expand Down
6 changes: 4 additions & 2 deletions docker/app/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,13 +138,15 @@ WORKDIR /app

# rexml: CVE-2025-58767, rack: CVE in system gem shipped with base image — both must be explicitly updated since they're bundled with ruby
# erb: CVE-2026-41316
# resolv: CVE-2026-80212, CVE-2026-80213
# gem cleanup removes old gemspecs that vulnerability scanners (e.g. Trivy) would otherwise flag
RUN gem update --system \
&& gem update rexml rack erb net-imap \
&& gem cleanup rexml rack erb net-imap \
&& gem update rexml rack erb net-imap resolv \
&& gem cleanup rexml rack erb net-imap resolv \
&& gem uninstall -i /usr/local/lib/ruby/gems/4.0.0 net-imap -v 0.6.2 \
&& find /usr/local/lib/ruby/gems -path "*/specifications/default/erb-*.gemspec" -delete \
&& find /usr/local/lib/ruby/gems -path "*/specifications/default/net-imap-*.gemspec" -delete \
&& find /usr/local/lib/ruby/gems -path "*/specifications/default/resolv-*.gemspec" -delete \
&& gem install bundler --version=${BUNDLER_VERSION} \
&& bundle config set --local path /bundle \
&& chown -R app-user:${GROUP_ID} /bundle \
Expand Down
Loading