private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the…

Description

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.

Scores

EPSS (exploitation in 30 days)

0.68% · top 48% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.

Weakness

• CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362) (opens in a new tab)All about CWE-362 and its CVEs

Affected products

• HackerOne · private_address_check ruby gem

  • affected 0.5.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• RubyGemsprivate_address_checkGHSA-2xvj-j3qh-x8c3 (opens in a new tab)

References (1)

• https://github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-2xvj-j3qh-x8c3 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-3759](https://trackcve.app/badge/CVE-2018-3759.svg)](https://trackcve.app/cve/CVE-2018-3759)

Record last updated 16 Sept 2024, 20:26 UTC.