TI-2026-34352 Aliases CVE-2026-46727 GHSA-jfc8-2xw7-c79m

Race condition in Ruby

LOW 38CWE-362Published 2026-05-22 · Updated 2026-05-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00478 41st percentileScored 2026-11-07

Fix Fixed Ruby (ruby-lang): 4.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ruby	Ruby	4.0.0 to before 4.0.5	4.0.5	Patch available	CNA

Ruby Vendorruby Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ruby-lang:ruby::::::::	4.0.0 to before 4.0.5	Vulnerable	ruby

cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.0.5 Vulnerable ·ruby

Remediation

Fix · CNA Ruby (ruby-lang) Fixed in 4.0.5

Timeline

2026-10-02 Threatist record created from CVE-2026-46727
2026-10-03 Alias added: GHSA-jfc8-2xw7-c79m

References

Advisory 1

https://www.ruby-lang.org/en/news/2026/05/20/getaddrinfo-cve-2026-46727/

Other 1

https://hackerone.com/reports/3607434

TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
TI-2013-03637 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1… CVSS 2.0MEDIUM 6.8
TI-2018-11751 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5… CVSS 3.0CRITICAL 9.8

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences