# Crystal 1.20.3 is released!

DevFeed: [Crystal 1.20.3 is released!](<https://devfeed.tech/articles/crystal-1-20-3-is-released-22336.md>)

Original publisher: [Read original article](<https://crystal-lang.org/2026/07/02/1.20.3-released/>)

Author: Julien Portalier

Published: 2026-07-02T00:00:00Z

Content type: release

Language: en

Sources: [Crystal](<https://devfeed.tech/sources/crystal.md>)

Topics: [Crystal](<https://devfeed.tech/topics/crystal.md>), [releases](<https://devfeed.tech/topics/releases.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [YAML](<https://devfeed.tech/topics/yaml.md>), [Parser](<https://devfeed.tech/topics/parser.md>)

Tags: [parsing](<https://devfeed.tech/tags/parsing.md>), [release](<https://devfeed.tech/tags/release.md>), [releases](<https://devfeed.tech/tags/releases.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [yaml](<https://devfeed.tech/tags/yaml.md>)

## AI overview

Crystal 1.20.3 is a release that fixes two security vulnerabilities in its YAML parsers. The fixes address excessive nesting that could cause stack overflows and excessive YAML alias expansion associated with billion laughs attacks. The article recommends upgrading when processing YAML files from unknown origins.

## Source excerpt

We are announcing a new Crystal release 1.20.3 with fixes for two security vulnerabilities in the YAML parsers. We recommend upgrading as soon as possible if your application processes YAML files from unknown origins.