Skip to main content

New research: Apex vs Claude Code Security vs Codex Security on the same codebase.

Vulnerability disclosure

DNS timing race can trigger a use-after-free

CVE-2026-46727

Affected product
Ruby
Severity
High
CVSS
8.1
Weakness
CWE-362
Published

Disclosure summary

CVE-2026-46727 is a high-severity CWE-362 vulnerability in Ruby. DNS timing race can trigger a use-after-free. Cantina reproduced the behavior, verified its security impact, and coordinated disclosure with the affected maintainer.

Verification standard

Cantina publishes a disclosure only after reproducing the behavior, validating its security impact, and coordinating remediation with the affected project.