Jruby: An issue was discovered in Ruby 4 before 4.0.5. (CVE-2026-46727)

CVE-2026-46727 describes a race condition vulnerability in Ruby 4 versions prior to 4.0.5. The flaw occurs in the pthread-based getaddrinfo timeout handler, where a use-after-free condition can be triggered. This vulnerability can cause the Ruby process to crash when functions such as Addrinfo.getaddrinfo with a timeout or Socket.tcp with a resolv_timeout are called. Exploitation requires an attacker to delay DNS responses close to the user-specified timeout, which could be achieved via a malicious DNS server or resolver. Although memory corruption exploitation is theoretically possible, the primary observed impact is a denial of service via process crash. Ruby 4.0.5 includes a patch that fixes this issue.

Successful exploitation can cause a denial of service by crashing the Ruby process due to a use-after-free condition in the DNS resolution timeout handler. The vulnerability affects remote attackers who can manipulate DNS response timing. The CVSS score of 8.1 indicates high impact on confidentiality, integrity, and availability, but exploitation complexity is high due to the need to delay DNS responses precisely. No known exploits in the wild have been reported.

An official patch is available in Ruby version 4.0.5. Users and administrators should upgrade to Ruby 4.0.5 or later to remediate this vulnerability. No additional mitigations are specified by the vendor advisory.