What’s New

Ruby

Languages & Runtimes

A dynamic, open-source language focused on simplicity and productivity.

Latest · by RubyWebsite

Changelog

Ruby 3.3.12 Released

Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / de…

Security
  • Fix ERB deserialization guard bypass vulnerability via def_module and def_method
View originalPermalink

Ruby 4.0.6 Released

Ruby 4.0.6 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version…

View originalPermalink

Ruby 3.4.10 Released

Ruby 3.4.10 has been released. This release is a regular stable package release contains the version update of bundled gem net-imap. The net-imap.gem update contains some security fixes. Please see th…

Security
  • bundled gem net-imap contains security fixes
View originalPermalink

Ruby 4.0.5 Released

Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 unde…

Fixed
  • Fix build system regression in Ruby 4.0.4
Security
  • Fix use-after-free in pthread-based getaddrinfo timeout handler (CVE-2026-46727)
View originalPermalink

CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler

A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has bee…

Security
  • Fix use-after-free vulnerability in pthread-based getaddrinfo timeout handler (CVE-2026-46727)
View originalPermalink

Ruby 4.0.4 Released

Ruby 4.0.4 has been released. This is a routine update that includes bugfixes. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version…

View originalPermalink

Ruby 4.0.3 Released

Ruby 4.0.3 has been released. This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316 . If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, p…

Security
  • Fix CVE-2026-41316 in ERB 6.0.1.1
View originalPermalink

CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

We published security advisory for CVE-2026-41316. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class A deserialization vulnerability exists in ERB. This v…

Security
  • Fix deserialization vulnerability in ERB @_init guard bypass via def_module, def_method, and def_class
View originalPermalink

Ruby 3.2.11 Released

Ruby 3.2.11 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820 . Please see the GitHub releases for further details. This is the final release of the Ruby 3.2…

Security
  • Update zlib gem to address CVE-2026-27820
View originalPermalink

Ruby 3.3.11 Released

Ruby 3.3.11 has been released. This release includes an update to the zlib gem addressing CVE-2026-27820 , along with some bug fixes. Please see the GitHub releases for further details. This is the la…

Fixed
  • Fixed various bugs
Security
  • Updated zlib gem to address CVE-2026-27820
View originalPermalink