CVE-2018-3759

Severity: low (CVSS 3.7 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-13 · updated 2026-06-17
Weakness: CWE-362

Description

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.

Affected products

HackerOne private_address_check ruby gem: before 0.5.0 — fixed in 0.5.0

How to fix

Upgrade to a fixed version: HackerOne private_address_check ruby gem 0.5.0. Check the vendor advisory for mitigations.

References

https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147
https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147

Get alerted when CVE-2018-3759 or the next vulnerability affects your stack