Log in Start free

Vulnerability · Published May 22, 2026 · Assigned by mitre

CVE-2026-46727

High 8.1

In plain English

A high-severity race condition in Ruby from ruby-lang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTSjrubyno fix listedUBUNTU-CVE-2026-46727
Ubuntu:25.10jrubyno fix listedUBUNTU-CVE-2026-46727
Ubuntu:26.04:LTSjrubyno fix listedUBUNTU-CVE-2026-46727
Ubuntu:26.10jrubyno fix listedUBUNTU-CVE-2026-46727
Ubuntu:22.04:LTSruby3.0no fix listedUBUNTU-CVE-2026-46727
Ubuntu:24.04:LTSruby3.2no fix listedUBUNTU-CVE-2026-46727
Ubuntu:25.10ruby3.3no fix listedUBUNTU-CVE-2026-46727
Ubuntu:26.04:LTSruby3.3no fix listedUBUNTU-CVE-2026-46727
Ubuntu:26.10ruby3.3no fix listedUBUNTU-CVE-2026-46727

Affected products (as reported)

VendorProductVersions
ruby-lang Ruby 4.0.0 – before 4.0.5

Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References