Skip to content
Fencer Vulns
high 8.1

CVE-2026-46727 json

An issue was discovered in Ruby 4 before 4.0.5.

published 2026-05-22 5 mo ago modified 2026-09-08 2 mo ago also BIT-ruby-2026-46727 , BIT-ruby-min-2026-46727 , EUVD-2026-31477

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.

Patch / fix

  • bitnami ruby 4.0.5
  • bitnami ruby-min 4.0.5
  • ruby-lang Ruby 4.0.5
  • ruby4.0 openSUSE Tumbleweed 4.0.5-1.1

opensuse advisories openSUSE-SU-2026:10839-1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami ruby
>=4.0.0, <4.0.5
4.0.5
bitnami ruby-min
>=4.0.0, <4.0.5
4.0.5

Affected products

  • ruby-lang Ruby

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.