PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46727 Ruby Lang CVE debrief

A race condition in Ruby 4's pthread-based getaddrinfo timeout handler (rb_getaddrinfo) creates a use-after-free vulnerability. The flaw exists in ext/socket/raddrinfo.c when Addrinfo.getaddrinfo() or Socket.tcp() is called with a timeout parameter. A remote attacker who can delay DNS responses near the user-specified timeout window can trigger process crashes. The attack vector requires network positioning to manipulate DNS response timing, such as through a compromised authoritative DNS server or recursive resolver. Memory corruption exploitation is theoretically possible, though the primary impact is denial of service via process termination.

Vendor
Ruby Lang
Product
Ruby
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-05-26
Advisory published
2026-05-22
Advisory updated
2026-05-26

Who should care

Organizations running Ruby 4.0.0-4.0.4 in production environments, particularly those with externally-facing services that perform DNS resolution with user-controlled hostnames or timeout parameters. Cloud providers, hosting platforms, and applications using Ruby's socket libraries with timeout configurations are at elevated risk.

Technical summary

The vulnerability resides in rb_getaddrinfo() in ext/socket/raddrinfo.c, which implements timeout handling for DNS resolution using pthreads. The race condition occurs between timeout expiration and getaddrinfo completion, leading to use-after-free when the timeout handler frees resources still in use by the resolution thread. Affected APIs include Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:). The attack requires precise timing control over DNS responses, making exploitation complex but achievable for attackers with DNS infrastructure access.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Ruby to version 4.0.5 or later to eliminate the vulnerable code path
  • If immediate patching is not feasible, avoid using timeout parameters with Addrinfo.getaddrinfo() and Socket.tcp() where attacker-influenced DNS resolution is possible
  • Monitor for unexpected Ruby process crashes in applications performing DNS resolution with timeouts
  • Review DNS infrastructure for signs of timing manipulation attempts
  • Apply principle of least privilege to Ruby processes to limit impact of potential memory corruption

Evidence notes

Vendor advisory confirms affected versions 4.0.0 through 4.0.4, with fix in 4.0.5. HackerOne report indicates coordinated disclosure. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network attack vector with high attack complexity due to timing requirements.

Official resources

2026-05-22