A race condition in Ruby 4's getaddrinfo implementation can cause a use‑after‑free when the DNS response is delayed close to the user‑specified timeout. The resulting memory corruption can crash the Ruby process that calls Addrinfo.getaddrinfo with a timeout or Socket.tcp with a resolv_timeout. While the description only specifies a crash, the underlying use‑after‑free could theoretically be abused for arbitrary code execution if the attacker controls the allocator state, but no such exploitation has been confirmed.

Ruby 4 is affected up to but not including version 4.0.5. All installations of Ruby 4 that perform DNS resolution with timeout handling are vulnerable, regardless of platform or distribution.

The CVSS score of 8.1 indicates a high severity. Because the attack requires a delayed DNS response near the timeout, the likely vector is remote network traffic; a malicious authoritative or recursive resolver could trigger the flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no public exploit data is currently known. Nevertheless, the crash risk is real, and memory‑corruption exploitation is theoretically possible, especially on systems where Ruby processes run with elevated privileges.