CVE-2026-46727 Use after free in Ruby
A race condition in Ruby's DNS timeout handler causes a use-after-free, allowing remote attackers to crash processes or potentially execute code via malicious DNS responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46727?
CVE-2026-46727 is a high-severity use after free vulnerability in Ruby-Lang Ruby, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.
Weakness: CWE-362
Which versions are affected by CVE-2026-46727?
2 open source packages ship an affected version, including ruby and ruby-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ruby Bitnami | From 4.0.0 | 4.0.5 |
ruby-min Bitnami | From 4.0.0 | 4.0.5 |
Linux distribution packages (1)
ruby4.0 openSUSE:Tumbleweed | All versions | 4.0.5-1.1 |
Products include Ruby-Lang Ruby.
How do I fix CVE-2026-46727?
Upgrade ruby to 4.0.5 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-46727 being exploited?
There is no known exploitation of CVE-2026-46727 in the wild and no public exploit code.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as BIT-ruby-2026-46727, BIT-ruby-min-2026-46727, GHSA-jfc8-2xw7-c79m, MINI-hw54-f695-m9w5, UBUNTU-CVE-2026-46727, openSUSE-SU-2026:10839-1.