{"id":"ruby-news-368900070c9d","seq":285,"kind":"release","title":"CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler","url":"https://www.ruby-lang.org/en/news/2026/05/20/getaddrinfo-cve-2026-46727/","permalink":"https://vulnpulse.app/items/ruby-news-368900070c9d","summary":"A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…","severity":null,"techs":["ruby"],"cves":["CVE-2026-46727"],"tags":["security"],"source":{"id":"ruby-news","name":"Ruby News"},"published_at":"2026-05-20T00:00:00.000Z","fetched_at":"2026-10-21T16:17:45.609Z"}