CVE-2026-46727
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In Ruby 4 before 4.0.5, a use-after-free vulnerability exists in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c). A race condition allows a remote attacker who delays DNS responses near the user-specified timeout to crash a Ruby process calling Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible.
Risk Assessment
An attacker can remotely crash Ruby applications (DoS) by manipulating DNS responses, and potentially achieve code execution in the process context in extreme cases.
Recommendation
Upgrade Ruby to version 4.0.5 or later, which contains the fix.
Other vulnerabilities in Ruby
See all- CVE-2017-17405High
Ruby before 2.4.3 allows command injection in Net::FTP. Functions like get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open local files, which can lead to arbitrary command execution if the localfile argument starts with the '|' character.
- CVE-2014-6438High
The URI.decode_www_form_component method in Ruby before version 1.9.2-p330 allows remote attackers to cause a denial of service via a crafted string.
- CVE-2009-5147High
In Ruby versions 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8, there is a vulnerability that allows opening libraries with tainted names.
- CVE-2017-0898Critical
Ruby versions before 2.4.2, 2.3.5, and 2.2.8 are vulnerable to a malicious format string containing a precious specifier (*) with a huge negative value. This situation can lead to a buffer overrun, resulting in heap memory corruption or information disclosure from the heap.
- CVE-2017-11465Critical
The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script.
- CVE-2016-2337Critical
Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.
- CVE-2025-0306High
A vulnerability in the Ruby interpreter allows a Marvin Attack, enabling an attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
Original NVD description (English source)
An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.