Ruby 3.3.13 has been released. This release includes security fixes. Please check the topics below for details. Security advisories: CVE-2026-80212 and CVE-2026-80213 Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release updates the default gem resolv to 0.3.2, which fixes CVE-2026-80212 and CVE-2026-80213. Ruby 3.3 is in the s…
Ruby 3.4.12 has been released. This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release also includes other bugfixes. Please see the GitHub rel…
We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby. Background GitLab compiles regular expressions supplied by its users, such as patterns in…
Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation that GitLab’s CVE-2026-110264 relies on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.tar.…
Ruby 4.0.8 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.8.tar.gz SIZE: 23947459 SHA1: f79bc8217dd0edd7ecc0c1c0cb57e64a906258a5 SHA256: 0968e2ac4cbd6f1fd85d3092aed66cd3c2d8ba4a5e2493d6e6c6cb0c431897d2 SHA512: 011b741c8fe3160643739f8fd88f3a69b198260dabcd3cb791c1ffacdf…
We are pleased to announce the release of Ruby 4.1.0-preview1. Ruby 4.0 introduces “Ruby Box” and “ZJIT”, and adds many improvements. Ractor Language changes super in a module method that was called via super from a refinement method now works correctly. [[Feature #22309]] Module#clone and Module#dup no longer rewrite the lexical scope of copied methods. Constants and class variables resolve throu…
Ruby 3.4.11 has been released. This is a regular scheduled update release includes bugfixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.gz SIZE: 22492449 SHA1: ed687c91e79b20a755666adbc290695accd49d79 SHA256: 5c22be44524312b3d433d68739bcc530633b1da5ef8ba0afa0a37680da17d3de SHA512: cb951af61fb237ddf3213f5efec893a505242168003…
Ruby 4.0.7 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November. If a change arises that significantly affects users, a release may occur earlier than…
Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume…
Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-4…
Ruby 4.0.6 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.7 will be released in September, and 4.0.8 in November. If a change arises that significantly affects users, a release…
Ruby 3.4.10 has been released. This release is a regular stable package release contains the version update of bundled gem net-imap. The net-imap.gem update contains some security fixes. Please see the release note of net-imap v0.5.15 for the detailed update of net-imap.gem. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz SIZ…
Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065]. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the mo…
A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727. This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., re…
Ruby 4.0.4 has been released. This is a routine update that includes bugfixes. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.5 will be released in July, 4.0.6 in September, and 4.0.7 in November. If a change arises that significantly a…
Ruby 4.0.3 has been released. This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316. If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. You may use this Ruby 4.0.3 release to do so. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.…
We published security advisory for CVE-2026-41316. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class A deserialization vulnerability exists in ERB. This vulnerability has been assigned the CVE identifier CVE-2026-41316. We recommend upgrading the erb gem. Scope Any Ruby application that calls Marshal.load on untrusted data AND has both erb and activesu…
Ruby 3.2.11 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820. Please see the GitHub releases for further details. This is the final release of the Ruby 3.2 series. We will not provide any further updates, including security fixes, for the Ruby 3.2 series. We recommend upgrading to Ruby 3.4 or 4.0. Download https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.…
Ruby 3.3.11 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820, along with some bug fixes. Please see the GitHub releases for further details. This is the last release of normal maintenance for the Ruby 3.3 series. After this release, Ruby 3.3 enters a security maintenance phase. During this phase, we will only backport security fixes and fixes for critica…
Ruby 4.0.2 has been released. This is a routine update that includes a bugfix in YJIT for NoMethodError on Puma. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.3 will be released in May, 4.0.4 in July, 4.0.5 in September, and 4.0.6 in November.…
Ruby 3.4.9 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820, along with other bug fixes. Please see the GitHub releases for further details. We recommend updating your version of the zlib gem. This release has been made for the convenience of those who wish to continue using it as a default gem. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.…