Ruby EUVD-2026-31477

The target application must call Addrinfo.getaddrinfo with the timeout: keyword argument or Socket.tcp with the resolv_timeout: keyword argument on a Ruby 4.x interpreter older than 4.0.5 - code that resolves names without those timeout options is not on the vulnerable path. The attacker additionally needs the ability to influence DNS responses observed by the victim near that user-specified timeout value, either by operating the authoritative name server for a hostname the application looks up or by controlling/MITM-ing the recursive resolver. No authentication or user interaction is required (PR:N/UI:N), but CVSS attack complexity is High (AC:H) because the attacker must reliably land the DNS reply within the narrow timing window that triggers the race, which limits opportunistic mass exploitation.

The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an unauthenticated, network-reachable bug that nonetheless requires winning a timing race - hence the High attack complexity. CIA all rated High is driven by the theoretical memory-corruption path; in practice the reliable outcome is crashing the Ruby process (denial of service), which the description and tags emphasize. EPSS, KEV, and SSVC data were not supplied, and no public exploit identified at time of analysis, so real-world exploitation pressure appears low at this point. Realistic priority: high for internet-facing Ruby services that resolve attacker-influenced hostnames with timeout: (e.g., webhook fetchers, SSRF-adjacent crawlers, mail relays) because an attacker controlling an authoritative DNS server or recursive resolver can repeatedly trigger the race; lower for internal applications resolving only trusted names.

An attacker who controls (or can MITM) the authoritative DNS server or recursive resolver consulted by a Ruby service repeatedly induces lookups for a hostname they own - for instance by sending webhook URLs, image URLs, or email addresses pointing at their domain - and delays each DNS response to land within microseconds of the application's configured timeout. Each well-timed reply triggers the race in rb_getaddrinfo and crashes the Ruby worker, producing a denial of service against the application; with sufficient control of heap state, the same primitive is theoretically usable for memory corruption, though no public exploit identified at time of analysis.