Executive brief
A security flaw has been identified in the Ruby programming language that could allow an attacker to crash applications or potentially execute unauthorized code. The issue occurs when the software handles network address lookups (DNS) with a specific timeout setting. By carefully timing a delayed DNS response, a remote attacker could cause the application to malfunction, leading to service outages or data corruption.
Technical details
A race condition exists in the pthread-based getaddrinfo timeout handler within Ruby's socket extension (rb_getaddrinfo in ext/socket/raddrinfo.c). The vulnerability is triggered when a DNS response is delayed such that it arrives precisely as the user-specified timeout is being processed, leading to a use-after-free scenario. Attackers can exploit this by controlling a malicious DNS server or recursive resolver to influence response timing. This affects calls to Addrinfo.getaddrinfo with a timeout parameter and Socket.tcp with a resolv_timeout parameter. While primarily resulting in a process crash, memory-corruption-based exploitation is theoretically possible. The issue is resolved in Ruby version 4.0.5.
Affected products
- Ruby-lang Ruby 4.0.0 through 4.0.4
Timeline
- 2026-05-20: patched: Ruby 4.0.5 released with fix
- 2026-05-20: advisory: Vendor advisory published by Ruby-lang
- 2026-05-22: disclosed: CVE published to NVD