io-event is vulnerable to Use After Free
68
Medium Risk
The native io-event extension keeps worker thread references that can go stale when Ruby compacts the heap, leading to use-after-free if the pool later uses those pointers. Internal selector and array allocations used raw libc allocators with debug-only assert checks, so release builds could dereference NULL and crash the VM when memory is exhausted instead of raising an exception. The patch adds GC compaction callbacks, movable marking, write barriers for WorkerPool, and switches selector internals to Ruby's xmalloc family so allocation failure is handled safely.
You are affected if you are using a version that falls within the vulnerable range.
io-event is vulnerable to Use After Free in versions 0.0.1 - 1.15.1.
Upgrade the io-event library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant