CVE-2026-46727

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-22 · updated 2026-07-23
Weakness: CWE-362

Description

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.

Affected products

Ruby: from 4.0.0 before 4.0.5 — fixed in 4.0.5

How to fix

Upgrade to a fixed version: Ruby 4.0.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-46727 or the next vulnerability affects your stack