CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler

A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…

Ruby Newsで読む

2026/05/20 09:00、Ruby Newsが「CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler」を公開しました (種別: リリース・告知)。関連する技術: Ruby。CVE: CVE-2026-46727。