Ruby 4.0.7 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November. If a change arises that significantly affects users, a release may occur earlier than…
Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume…
Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-4…
Ruby 4.0.6 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.7 will be released in September, and 4.0.8 in November. If a change arises that significantly affects users, a release…
Ruby 3.4.10 has been released. This release is a regular stable package release contains the version update of bundled gem net-imap. The net-imap.gem update contains some security fixes. Please see the release note of net-imap v0.5.15 for the detailed update of net-imap.gem. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz SIZ…
Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065]. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the mo…
A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727. This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., re…
Ruby 4.0.4 has been released. This is a routine update that includes bugfixes. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.5 will be released in July, 4.0.6 in September, and 4.0.7 in November. If a change arises that significantly a…
Ruby 4.0.3 has been released. This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316. If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. You may use this Ruby 4.0.3 release to do so. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.…
We published security advisory for CVE-2026-41316. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class A deserialization vulnerability exists in ERB. This vulnerability has been assigned the CVE identifier CVE-2026-41316. We recommend upgrading the erb gem. Scope Any Ruby application that calls Marshal.load on untrusted data AND has both erb and activesu…
Ruby 3.2.11 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820. Please see the GitHub releases for further details. This is the final release of the Ruby 3.2 series. We will not provide any further updates, including security fixes, for the Ruby 3.2 series. We recommend upgrading to Ruby 3.4 or 4.0. Download https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.…
Ruby 3.3.11 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820, along with some bug fixes. Please see the GitHub releases for further details. This is the last release of normal maintenance for the Ruby 3.3 series. After this release, Ruby 3.3 enters a security maintenance phase. During this phase, we will only backport security fixes and fixes for critica…
Ruby 4.0.2 has been released. This is a routine update that includes a bugfix in YJIT for NoMethodError on Puma. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.3 will be released in May, 4.0.4 in July, 4.0.5 in September, and 4.0.6 in November.…
Ruby 3.4.9 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820, along with other bug fixes. Please see the GitHub releases for further details. We recommend updating your version of the zlib gem. This release has been made for the convenience of those who wish to continue using it as a default gem. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.…