Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-20 | 1 | Patch1 |
| 2026-05-21 | 1 | Patch1 |
| 2026-09-12 | 2 | Active Exploitation1Disclosure1 |
We released Ruby 4.0.5 and published security advisory for CVE-2026-46727. If you use Ruby 4.0.0~4.0.4, we recommend updating your Ruby version to 4.0.5. https://www.ruby-lang.org/en/news/2026/05/20/ruby-4-0-5-released/
Post summary
Ruby 4.0.5 has been released with a security advisory for CVE-2026-46727; users of Ruby 4.0.0‑4.0.4 are urged to upgrade.
@cantinasecurity @tenbinlabs Did you know this? (during finding incident CVE-2026-46727 in May at Rubygems) https://t.co/ZfsDjmMOsH
Post summary
The tweet announces the discovery of CVE-2026-46727 at Rubygems but provides no further technical detail, PoC, or exploitation context.
@coe401_ Did you notice anything about the https://open.ai model breakout hack in May during patching incident CVE-2026-46727 in the same time at @rubygems ? https://t.co/U5274asP0S
Post summary
The tweet references a real‑world breakout hack linked to CVE‑2026‑46727, but it lacks technical, PoC, or patch details, leaving the precise nature of the vulnerability unclear.
【プログラミングニュース 第21週】 今週のハイライト： - Node.js v24.16.0 LTS + v26.2.0 同時リリース - KotlinConf 2026：VS Code公式Alpha対応 - WordPress 7.0 メジャーリリース - Ruby 4.0.5 セキュリティ修正（CVE-2026-46727） - Misskey：5件のCVE修正 📺 https://youtu.be/uJFT63dY4BY
Post summary
The article announces that Ruby 4.0.5 includes a security fix for CVE‑2026‑46727, with no additional exploit or technical detail provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ruby-lang | ruby | - | - | - |