「CVE-2026-46727」の検索結果
5月20日(水)
Ruby 4.0.5 Released
Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065] . Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.6 will be released in July, 4.0.7 in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than plann…
CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler
A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…