---
title: "CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler"
url: https://daily.dev/posts/cve-2026-46727-use-after-free-in-pthread-based-getaddrinfo-timeout-handler-wsx4kaak6
source_url: https://www.ruby-lang.org/en/news/2026/05/20/getaddrinfo-cve-2026-46727
type: article
source: "Ruby"
published: 2026-05-20T00:38:47.904Z
updated: 2026-05-20T00:39:06.429Z
tags: ["security", "ruby"]
reading_time: 2
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler

**[Ruby](https://daily.dev/sources/ruby)** · 2 min read · 1 upvotes · 0 comments

## Summary

A use-after-free vulnerability (CVE-2026-46727) has been found in Ruby's pthread-based getaddrinfo timeout handler. A race condition in the timeout cancellation path of rb_getaddrinfo, used by Addrinfo.getaddrinfo and Socket.tcp, can allow a remote attacker who delays DNS responses near the timeout threshold to cause the Ruby process to dereference freed memory and crash. Affected versions are Ruby 4.0.0 through 4.0.4 and 4.1.0-dev before the fix. Ruby 3.4 and earlier are not affected. The fix is included in Ruby 4.0.5. As a workaround, avoid passing timeout: to Addrinfo.getaddrinfo or resolv_timeout: to Socket.tcp.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.ruby-lang.org/en/news/2026/05/20/getaddrinfo-cve-2026-46727>

## Similar posts on daily.dev

- [Ruby 4.0.5 Released](https://daily.dev/posts/ruby-4-0-5-released-twcsdi9wj) · Ruby · 1 upvotes · 0 comments
- [Security advisories: CVE-2026-80212 and CVE-2026-80213](https://daily.dev/posts/security-advisories-cve-2026-80212-and-cve-2026-80213-vuu5utu0z) · Ruby · 1 upvotes · 1 comments
- [RIP pthread\_cancel](https://daily.dev/posts/rip-pthread-cancel-4wldzmn75) · Hacker News · 1 upvotes · 0 comments
- [CVE-2026-47241 \(net-imap\): Net::IMAP: Denial of Service via incomplete raw argument validation](https://daily.dev/posts/cve-2026-47241-net-imap-net-imap-denial-of-service-via-incomplete-raw-argument-validation-fpkbpelcz) · RUBYLAND · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby)

[View this post on daily.dev](https://daily.dev/posts/cve-2026-46727-use-after-free-in-pthread-based-getaddrinfo-timeout-handler-wsx4kaak6)