CVE-2026-46727

CVSS

—

EPSS

0.005 (39.3th percentile)

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++20 May, 00:12

  Ruby 4.0.5 Released

  Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065]. Please see the GitHub releases for further details. Release Schedule We…

  ↗ruby-lang.org/en/news/2026/05/20/ruby-4-0-5-rel…(opens the publisher's site in a new tab)

• Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++20 May, 00:00

  CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler

  A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727. This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout…

  ↗ruby-lang.org/en/news/2026/05/20/getaddrinfo-cv…(opens the publisher's site in a new tab)

What we observed