## CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler

- 種別: release
- 関連技術: ruby
- CVE: CVE-2026-46727
- 公開日時: 2026-05-20T00:00:00.000Z
- 情報源: Ruby News (https://www.ruby-lang.org/en/news/2026/05/20/getaddrinfo-cve-2026-46727/)
- パーマリンク: https://vulnpulse.app/items/ruby-news-368900070c9d

A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…