# Ruby-lang The latest news from ruby-lang.org. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Ruby 4.0.7 Released DevFeed: [Ruby 4.0.7 Released]() Original publisher: [Read original article]() Published: 2026-09-15T00:25:58Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [releases](), [bug]() Tags: [2026](), [bugfixes](), [contributions](), [download](), [release](), [release-schedule](), [releases](), [ruby](), [sha256](), [xz](), [zip]() ### AI overview Ruby 4.0.7 has been released as a routine update containing bugfixes. The article says Ruby 4.0.8 is planned for November, with earlier release possible if a significant user-impacting change arises. ### Source excerpt Ruby 4.0.7 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November. If a change arises that significantly affects users, a release may occur earlier than planned. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.gz SIZE: 23937964 SHA1: 730d4f8cebb60a1f5b556e7b58d86d0301772558 SHA256: 911ace20f90d068ca0e4dda6d0e4f0f81e52e52f2dd4f4004c721e253412e82d SHA512: ca6fb2df4b39967f1a92399ab70579216f2a87e600d127a616d4a81a3c92b25ebf35849502a2c12e2251d69e67eade3888af4a41b8844054d5c774f07c237c6d https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.xz SIZE: 17995980 SHA1: 7d2307f975b1fef4e0ffe5cfe13067f993b5a4c2 SHA256: 47ef59413f7a4587ba6a6b78b14036eb5e36eec2ec0b90964801e88d56a3d375 SHA512: d1d345c25bff43aa86f536b22cd04746a7d3372077bf47ec75ef1820c0b43d0dbe3573dd5e5c55ee517796f46f0cdbd22c7506aebd06581241eefb5ffd9d2e5f https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.zip SIZE: 29248954 SHA1: 82b1bce8abb650e3080b96a0beff810b690dafa4 SHA256: c6f889c6dccd2625ae8d595bdee8e92afb3ddae3a1669bad67bb9f24d6af30ab SHA512: 5456ee1260921589cad5f0c57e84715e9c26b1f438a4c141157093c8e37e7e5d499a96c0ed35641f3cea1b741ecda2d72bfa3ce79fdbd5491784d9e6d181ac09 Release Comment Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions. Posted by k0kubun on 15 Sep 2026 ## Security advisories: CVE-2026-80212 and CVE-2026-80213 DevFeed: [Security advisories: CVE-2026-80212 and CVE-2026-80213]() Original publisher: [Read original article]() Published: 2026-08-27T00:00:00Z Content type: news Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [Vulnerabilities](), [Security](), [Network]() Tags: [2026](), [cve](), [dependencies](), [dependency](), [dns](), [end-of-life](), [memory](), [network](), [ruby](), [security](), [update](), [vulnerabilities]() ### AI overview Ruby's bundled resolv gem has two vulnerabilities: malicious DNS responses can cause unbounded memory exhaustion, and specially crafted overlong hostnames can bypass hostname validation. The advisory identifies affected versions and recommends updating the gem. ### Source excerpt Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213. We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of memory and the service stops. CVE-2026-80213: Hostname validation bypass An application that checks a hostname against an allow list or an SSRF filter and then resolves it can be made to look up a domain other than the one it checked. The string that passes validation and the name that reaches the network are not the same, so the connection can end up at a host the application never approved. This requires a hostname that exceeds the DNS length limits, so validation that rejects names longer than 255 octets, or labels longer than 63 octets, is not affected. Affected versions resolv gem 0.4.0 through 0.7.1 resolv gem 0.3.1 and earlier The version bundled with Ruby differs per series: Ruby 4.0 ships resolv 0.7.0, Ruby 3.4 ships 0.7.1, and Ruby 3.3 ships 0.3.1. What to check Only code that resolves names through this gem is affected. Ordinary socket connections, including Net::HTTP and anything built on TCPSocket, use the operating system resolver and are not. Net::HTTP does load the gem, but only for its IP address regular expressions, so a loaded gem is not by itself a sign of exposure. An application reaches the affected code by calling Resolv itself, by loading resolv-replace, which routes all socket name resolution through the gem, or through a dependency that resolves names this way. Check your dependencies as well as your own code. Recommended action Update the resolv gem to 0 ## Ruby 3.3.12 Released DevFeed: [Ruby 3.3.12 Released]() Original publisher: [Read original article]() Published: 2026-07-16T05:08:11Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [releases](), [Release notes](), [Security]() Tags: [2026](), [cve](), [download](), [release](), [release-notes](), [releases](), [ruby](), [security]() ### AI overview Ruby 3.3.12 has been released with security fixes. The update includes erb 4.0.3.1 and net-imap 0.4.25, which fixes multiple listed CVEs, including CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241, and CVE-2026-47242. ### Source excerpt Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242. Please see the release notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these fixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.12.tar.gz SIZE: 21489887 SHA1: 1ecad817a7d3727db65cf898a51d9956888cee5b SHA256: b06d63beae271933033e27f0a389bc582a009e7845357d44365c39de525a051b SHA512: 7c620438e85beb6744acc7d1e917af554238739883d592aa9839fca78514c11e91dfd8c4b5ce611d1ea507a4412ed81f3a8b5fc6eb07ba3e392a77b518de6829 https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.12.tar.xz SIZE: 15891224 SHA1: 7df70ae8a9feb880e2ad5054dfebd712ba03d0eb SHA256: 873e3297990b8cff7a5436f6e510a3a7a18c74e5f2c794e4162e605fe0a743b3 SHA512: 1755901f5d1e66250e4f9f4e3a0bf31ec25055f1cb86fafc68281f6d108e9cf5329a6c74c221b1a31aa7de78e9c2d8aa7b76faf39acfce44c5ed94cf7e766f3f https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.12.zip SIZE: 26954647 SHA1: 8be5a3c6f4a8821ce5326a9e09d4230c9fa06faa SHA256: fc1aecfb45adeb7bebbf9549d45ce6e57f0c9dac8b83cdeb80680de02a83ce41 SHA512: ff5a0339310c464b88a444871f901f41fc735f77668b29dfc70389aae5d44fd90b55cff6c02d47a23596663525b526a86f9906c08c371d37e3fb105ea9c6b1a9 Release Comment Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions. Posted by hsbt on 16 Jul 2026 ## Ruby 4.0.6 Released DevFeed: [Ruby 4.0.6 Released]() Original publisher: [Read original article]() Published: 2026-07-14T01:41:20Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [releases]() Tags: [2026](), [bugfixes](), [download](), [release](), [release-schedule](), [releases](), [ruby]() ### AI overview Ruby 4.0.6 has been released as a routine update containing bugfixes. The article provides download links and checksums, and says Ruby 4.0.7 is planned for September 2026 and Ruby 4.0.8 for November 2026. ### Source excerpt Ruby 4.0.6 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.7 will be released in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.tar.gz SIZE: 23904779 SHA1: bd2b5a5bdf0ac9947eab242f418bef10c8851712 SHA256: 837d299e8f7ddf2be31a229a7a7e019d354979825117989acb3b32b1a9be262a SHA512: 0c050ac9b806facb1e1ec1f6a8def7fc33cf1ccfb57a502b1fc467e76e534e7eaf60297fb08e35e89c8727510903f48c73ccc8f9888a017cd6032379e84ed83e https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.tar.xz SIZE: 17968092 SHA1: 1b55f5159fec2bfa08147fc91d23643ab176c009 SHA256: 9c9d121fe3314ea7c801e690b9de981d2b9d12d7849db99c27482468a541ba0a SHA512: c9c391675a098b5a27dd687571ab0a164c788cbb8ddcbab6d17a3e8b3c4ba389346b2e6d7807d38db3e74d225c70e378a296d60d0f465cb0fcec9702242c83c6 https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.zip SIZE: 29211551 SHA1: 27609f5815902a5b4dd54d5c8ee798acd90e4efe SHA256: f0f7b0ee34882ab797fc6a88262d19f5783e87f7b984dbc133cfd09c24eefcb6 SHA512: 3a0b87cf6934ec02d84bd5cf9e299904daf3de4625c0fc58781273abb7e0ae1497fc208c82d48fa6203643612c195c5267baa470e517cee179dca82e67104742 Release Comment Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions. Posted by k0kubun on 14 Jul 2026 ## Ruby 3.4.10 Released DevFeed: [Ruby 3.4.10 Released]() Original publisher: [Read original article]() Published: 2026-06-30T12:00:00Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [releases](), [Security](), [GitHub]() Tags: [2026](), [release](), [releases](), [ruby](), [security](), [sha256]() ### AI overview Ruby 3.4.10 is a regular stable package release that updates the bundled net-imap gem, including security fixes. The release provides source downloads in tar.gz, tar.xz, and ZIP formats with checksums. ### Source excerpt Ruby 3.4.10 has been released. This release is a regular stable package release contains the version update of bundled gem net-imap. The net-imap.gem update contains some security fixes. Please see the release note of net-imap v0.5.15 for the detailed update of net-imap.gem. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz SIZE: 22476870 SHA1: 5eac73bce00e770e19b50b69032578df9b2bb41c SHA256: ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec SHA512: 493c9be80a78a4ddf983620295c79ae9f1c8e4c60da8237e12965fa6f95dda6548b3ff3cd311fe774cc8237e18ad2b2514dd029c46c8f4eabea6613a39d7745b https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.xz SIZE: 16709188 SHA1: 8655291cc2e7547d10db5e81f9baac8cdbbbf702 SHA256: 6f32ad662baafc228d12030dbcd284f83b034dd4337b300dc84ac74d11a1eb68 SHA512: c28d59946c0a1b8e4385a772e0651c6f4154c18ab8a2a62289c3213eb4fe937cec0942e0076cda429576e58ad277b18f4b5611e644d15b122c1cd96baf10f284 https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.zip SIZE: 27697773 SHA1: 09dd69e25c393071bd0550da5f4983ee4d9550a3 SHA256: 3b18a22a2ea1bed8df645b1568ba13eb659baeed3a2a1a7f67a21ca604e68a13 SHA512: 1516ee66d878480b8d7164a002d3087268a79c380ba4807172b26260644f39bac4b7f781b62a815e46bc1107edf578f6cf4eae9aebc8fe86416978e737865278 Release Comment Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions. Posted by nagachika on 30 Jun 2026 ## Ruby 4.0.5 Released DevFeed: [Ruby 4.0.5 Released]() Original publisher: [Read original article]() Published: 2026-05-20T00:12:20Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [releases](), [Security]() Tags: [2026](), [bug](), [build](), [cve](), [release](), [releases](), [ruby](), [security]() ### AI overview Ruby 4.0.5 has been released with a security fix for CVE-2026-46727, addressing a use-after-free in the pthread-based getaddrinfo timeout handler, along with a build system regression in Ruby 4.0.4 under the C locale. ### Source excerpt Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065]. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.6 will be released in July, 4.0.7 in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.5.tar.gz SIZE: 23818557 SHA1: efa77332e323c15a86e1a25a3ae53bd21972672c SHA256: 7d6149079a63f8ae1d326c9fa65c6019ba2dc3155eae7b39159817911c88958e SHA512: ce50c8dda1479f5a84771df37cdb23f0183bba900494e7492bb90d4b0a3e60ff28b799f3c469977f5f7c1335a6c1f3400a9ca52cd4acfcbed08f016d352943f4 https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.5.tar.xz SIZE: 17893756 SHA1: 58216f1858feed4e2dbd2719a0a7ae807563b428 SHA256: 5dc5521ea54c726e6cc10b1b5a0f4004b27b482e61c04c99aed79315e30895e5 SHA512: 379d78a6d1af0455df60da46551f43438ad3ee81f83787554fc34cb1c8febb1bd363e3dc1a057b34a69f96526efc308d3dccc4b87d368897c2d1ccf179096463 https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.5.zip SIZE: 29122529 SHA1: cda48124428ae33497f191bb676c8022615ab91e SHA256: 605f8b22e12f5cfc3f4a48850a7fe7dc9b010002d2c994d7508f38c63d2c0ff8 SHA512: c4faaefa386bb33dc4cb3994d740b0c8b4756726351df6cc0850dbd2598f3ba51dcfb38bd61d91f63adf3612bb5f6dbd727446caf9af78f5df36e7d31ecf113a Release Comment Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions. Posted by k0kubun on 20 May 2026 ## CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler DevFeed: [CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler]() Original publisher: [Read original article]() Published: 2026-05-20T00:00:00Z Content type: news Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [vulnerability](), [race-condition](), [Security]() Tags: [2026](), [cve](), [race-condition](), [ruby](), [security](), [vulnerability]() ### AI overview Ruby discloses CVE-2026-46727, a use-after-free vulnerability in the pthread-based getaddrinfo timeout handler. A race condition may cause a Ruby process to crash when an attacker delays DNS responses near the specified timeout. Ruby 4.0.5 fixes the issue. ### Source excerpt A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727. This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:). A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4.0.5 or later. Workaround If you cannot upgrade immediately, avoid passing timeout: to Addrinfo.getaddrinfo and resolv_timeout: to Socket.tcp. Affected versions Ruby 4.0.0 through 4.0.4 Ruby 4.1.0-dev (master) before the fix Ruby 3.4 series and earlier are not affected. Credits Thanks to cantina-security for discovering this issue. Also thanks to shioimm for creating the patch. History Originally published at 2026-05-20 00:00:00 (UTC) Posted by hsbt on 20 May 2026 ## Ruby 4.0.4 Released DevFeed: [Ruby 4.0.4 Released]() Original publisher: [Read original article]() Published: 2026-05-11T21:41:38Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [releases]() Tags: [2026](), [bugfixes](), [contributions](), [developers](), [download](), [release](), [release-schedule](), [releases](), [ruby](), [sha256](), [xz](), [zip]() ### AI overview Ruby 4.0.4 has been released as a routine update containing bug fixes. The article provides download links, checksums, the planned Ruby 4.0 release schedule, and acknowledgments to contributors. ### Source excerpt Ruby 4.0.4 has been released. This is a routine update that includes bugfixes. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.5 will be released in July, 4.0.6 in September, and 4.0.7 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.4.tar.gz SIZE: 23816838 SHA1: 3633db75e6b4848b509ecccc64704d8f4467f068 SHA256: f35f6edfa3dabb3f723f9d0cf1906c6512ae77f4e412ab1e68cc6e91d230fa80 SHA512: b0cc9af75ee25628483a32ecd5ea6477d637ee3c75795f411bc4ebde7d86ab754fddf96385cfc5955b9dbd016418cbd7178c82dad7876b2b7119238f5159ed3a https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.4.tar.xz SIZE: 17899740 SHA1: 9e070a8a78e6faa35382360b47526042657b236d SHA256: 6ff9d2d6e75f5a6f997222ecc45f79209d663737eceb3689d1f42ab952673fb7 SHA512: cccc041379fd4e46a736a5c10ccf81627766a7175113c34754797b915bebcd0ce821d9cd7b42cc616b0a1f9ee38eee5ab7560c1840fa6672819c293e498a3f6f https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.4.zip SIZE: 29122429 SHA1: 5edc7ce0adc2851a355673a5bb42b75efd4cf2b2 SHA256: 508bc83baed022c20671d69dd264e6783d61b89767b5d387c0f8efea00b62219 SHA512: b5db7ba616c56bdac9a61362d88d6350c8a8b59b5d812c1395476db73cb60fb403994e0bc3285aa2f57acbef3e30bcfce4bee4c5c8433b39d8f0a7c6dbb9bd29 Release Comment Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions. Posted by k0kubun on 11 May 2026 ## Ruby 4.0.3 Released DevFeed: [Ruby 4.0.3 Released]() Original publisher: [Read original article]() Published: 2026-04-21T08:45:44Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [bug]() Tags: [2026](), [contributions](), [cve](), [download](), [release](), [release-schedule](), [ruby]() ### AI overview Ruby 4.0.3 has been released as a security-focused update containing ERB 6.0.1.1, which fixes CVE-2026-41316. The article advises affected applications using Marshal.load on untrusted data with erb and activesupport loaded to update ERB. ### Source excerpt Ruby 4.0.3 has been released. This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316. If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. You may use this Ruby 4.0.3 release to do so. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.4 will be released in May, 4.0.5 in July, 4.0.6 in September, and 4.0.7 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.3.tar.gz SIZE: 23806898 SHA1: 619db0f25713a8f007d5889ae6e66ba0d31118e8 SHA256: 77964acc370d5c8375b9502e5ba6c13c03ef91ab9eb9f521c84fb42b9c9a6b0f SHA512: 6fd12620869a9a36fa2e1cce302de42f429ab9e9fae1fe3b0901ca1a1b3a606a83feed87f4b76935beb715e8a750cf718f88afef2de4e866ad574b33abb12dbe https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.3.tar.xz SIZE: 17878572 SHA1: faf1f3df171d2160116d190ca32b6b00e0338bfa SHA256: 22cf6005d25bbe496b5ebe9224d63a1aaabfbfe02591bb5d612517c5a7836f29 SHA512: 5816fb264ce76df59f4bfe0cadceb45025fada2e61f2c14024d6b03f63d304820cddf94afcf82a4951fd12f3b0d9148683f856f3f2245d56042fc8407b6cbff5 https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.3.zip SIZE: 29109899 SHA1: d19d91723d7a19a34b860eee8544093f64c9d92f SHA256: a80f1a3162950cfc1ef70f066132005efbb817f7ab6f16dcc244e5f015aabbc2 SHA512: 48b18fc578b5d7cd362a549ff5091c749d0460122f5dc3701fd6dada8016253fe0e85c498e20943e1a7f360b1e9fd073939da00df4b0c8a1afdddc16c43e43bc Release Comment Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions. Posted by k0kubun on 21 Apr 2026 ## CVE-2026-41316: ERB @\_init deserialization guard bypass via def\_module / def\_method / def\_class DevFeed: [CVE-2026-41316: ERB @\_init deserialization guard bypass via def\_module / def\_method / def\_class]() Original publisher: [Read original article]() Published: 2026-04-21T07:51:00Z Content type: news Language: en Sources: [Ruby-lang]() Topics: [vulnerability](), [Security](), [Ruby](), [Rails]() Tags: [cve](), [rails](), [ruby](), [ruby-on-rails](), [security](), [update](), [vulnerability]() ### AI overview Ruby reports CVE-2026-41316, a deserialization vulnerability in ERB. Ruby applications that call Marshal.load on untrusted data with erb and activesupport loaded may be vulnerable to arbitrary code execution. The advisory recommends upgrading the erb gem to a fixed version. ### Source excerpt We published security advisory for CVE-2026-41316. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class A deserialization vulnerability exists in ERB. This vulnerability has been assigned the CVE identifier CVE-2026-41316. We recommend upgrading the erb gem. Scope Any Ruby application that calls Marshal.load on untrusted data AND has both erb and activesupport loaded is vulnerable to arbitrary code execution. This includes: Ruby on Rails applications that import untrusted serialized data - any Rails app (every Rails app loads both ActiveSupport and ERB) using Marshal.load for caching, data import, or IPC Ruby tools that import untrusted serialized data - any tool using Marshal.load for caching, data import, or IPC Legacy Rails apps (pre-7.0) that still use Marshal for cookie session serialization Details ERB implements an @_init guard to prevent code execution when ERB objects are reconstructed via Marshal.load on untrusted data. However, ERB#def_method, ERB#def_module, and ERB#def_class evaluate the template source without checking this guard, allowing an attacker who controls the data passed to Marshal.load to bypass the protection and execute arbitrary code. In particular, def_module takes no arguments, making it straightforward to invoke as part of a deserialization gadget chain. Please update the erb gem to version 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. Affected versions erb gem 6.0.3 or lower Credits Thanks to TristanInSec for discovering this issue. History Originally published at 2026-04-21 07:51:00 (UTC) Posted by k0kubun on 21 Apr 2026 ## Ruby 3.2.11 Released DevFeed: [Ruby 3.2.11 Released]() Original publisher: [Read original article]() Published: 2026-03-27T00:00:00Z Content type: release Language: en Sources: [Ruby-lang]() Topics: [Ruby](), [releases](), [Security](), [GitHub](), [Zip]() Tags: [2026](), [cve](), [download](), [github](), [release](), [releases](), [ruby](), [security](), [sha256](), [zip]() ### AI overview Ruby 3.2.11 has been released with an update to the zlib gem addressing CVE-2026-27820. It is the final Ruby 3.2 release, with no further updates or security fixes planned for the series; users are recommended to upgrade to Ruby 3.4 or 4.0. ### Source excerpt Ruby 3.2.11 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820. Please see the GitHub releases for further details. This is the final release of the Ruby 3.2 series. We will not provide any further updates, including security fixes, for the Ruby 3.2 series. We recommend upgrading to Ruby 3.4 or 4.0. Download https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.2.11.tar.gz SIZE: 19984344 SHA1: 9534a3aa08d2ccb4d3c50b1301b2da9a9b91c4ab SHA256: b3eeabd6636f334531db3ffdc3229eb05e524740e6c84fdc043720573cf2f8b2 SHA512: 95896bbf519604da0dc3d82066ac92c3f661b2ee9ffd8e2c9effce4773677445f1dcc43b05539050024b57f4f94f43984a734a03015ac6e29679e79d5a093a67 https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.2.11.tar.xz SIZE: 14695828 SHA1: 501cecc15ba079087967888ae455d62e5886fbc1 SHA256: c13aec0c206725d5d356acbae6e5fd8bffd92dc325aec14fd5dd7795d4b763d2 SHA512: 418739d476d34e2467e7f1ee60ff63a1969a362b49871bdc488676c1ac7d28b198deee85e2bd951a23f5b0e8425bc89ca59d5c8cb8415fa5ed835555e3d3af8d https://cache.ruby-lang.org/pub/ruby/3.2/ruby-3.2.11.zip SIZE: 24594356 SHA1: 7e84c9433f32a758da123d3b5532cc632d19d503 SHA256: 08ab90aa4ada9268e96aa47fb6c3a77fdb3b2f792f2671053e3b55a6141618ce SHA512: 133d63cd9bb7c9fe38eecd18c996013de0a56fef09c89c42f4fc9c383f09ab4ab3b0b31edbadd1fd1aaa797fbb9c86128ded51c6e5263cd3225754e714b3d195 Release Comment Since the initial release of Ruby 3.2.0 on December 25, 2022, the Ruby 3.2 series has been supported for over three years. We would like to thank all committers, developers, and users who provided bug reports and contributions throughout the life of the Ruby 3.2 series. Posted by hsbt on 27 Mar 2026