CVE-2018-3759
private_address_check contains race condition
CVE-2018-3759 is a low vulnerability (CVSS 3.7) in Hackerone Private Address Check Ruby Gem, published June 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in private_address_check 0.5.0.
- Severity
- 3.7 LowCVSS 3.0, NVD
- Exploit chance
- 0.68%EPSS, 52nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.5.0private_address_check +1 more
Description
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
private_address_checkRubyGems | before 0.5.0 | 0.5.0 |
private_address_checkRubyGems | before 0.5.0, plus listed versions 0.1.00.2.00.3.00.4.00.4.1 | 0.5.0 |
What each source reports
NVD Score used
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
- Record
CVE-2018-3759- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE ListNo score
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
- Record
CVE-2018-3759- Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2018-0210No score
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
- Record
EUVD-2018-0210- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2xvj-j3qh-x8c3No score
private_address_check contains race condition
The private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
- Record
GHSA-2xvj-j3qh-x8c3- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
- Record
CVE-2018-3759- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-2xvj-j3qh-x8c3No score
private_address_check contains race condition
The private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
- Record
GHSA-2xvj-j3qh-x8c3- Weakness
- CWE-362
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/jtdowney/private_address_check/commit/4068228187db87fea7577f7020099399772bb147
nvd.nist.gov/vuln/detail/CVE-2018-3759