CVE-2026-46727
Fixed in a distro release EPSS <1%CVSS 8.1
An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.
Products: ruby-lang ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 16.04 LTS | jruby | no fix |
| Ubuntu 18.04 LTS | jruby | no fix |
| Ubuntu 20.04 LTS | jruby | no fix |
| Ubuntu 22.04 LTS | ruby3.0 | no fix |
| Ubuntu 24.04 LTS | jruby | no fix |
| Ubuntu 24.04 LTS | ruby3.2 | no fix |
| Ubuntu 25.10 | jruby | no fix |
| Ubuntu 25.10 | ruby3.3 | no fix |
| Ubuntu 26.04 LTS | jruby | no fix |
| Ubuntu 26.04 LTS | ruby3.3 | no fix |
| Ubuntu 26.10 | jruby | no fix |
| Ubuntu 26.10 | ruby3.3 | no fix |
| Ubuntu Pro 14.04 LTS | jruby | no fix |
| Ubuntu Pro 16.04 LTS | ruby2.3 | no fix |
| Ubuntu Pro 18.04 LTS | ruby2.5 | no fix |
| Ubuntu Pro 20.04 LTS | ruby2.7 | no fix |
| openSUSE Tumbleweed | ruby4.0 | 4.0.5-1.1 |