Ruby versions prior to 4.0.5, specifically 4.0.0, contain a race condition (CWE-362) in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c). This race condition can cause a use-after-free error when DNS responses are delayed near the timeout specified by the user in Addrinfo.getaddrinfo or Socket.tcp calls. The flaw allows a remote attacker capable of delaying DNS responses, such as via a crafted authoritative DNS server or recursive resolver, to crash the Ruby process. While memory corruption exploitation is theoretically possible, no known exploits are documented. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring high attack complexity.

The vulnerability can cause a denial of service by crashing Ruby processes that perform DNS resolution with timeouts. Theoretically, it could lead to memory corruption, which might allow further exploitation, but no such exploits are known. The impact affects confidentiality, integrity, and availability of affected Ruby applications relying on the vulnerable DNS resolution functions.

No official patch or remediation level has been published by the vendor as of now. Users should monitor the ruby-lang project advisories for updates and apply any official fixes once available. Until then, consider avoiding or limiting use of Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) with untrusted DNS sources or implement external DNS resolution safeguards. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.