Ruby Newsの情報
10月23日(金)
Ruby 3.3.13 Released
Ruby 3.3.13 has been released. This release includes security fixes. Please check the topics below for details. Security advisories: CVE-2026-80212 and CVE-2026-80213 Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release updates the default gem resolv to 0.3.2, which fixes CVE-2026-80212 and CVE-2026-80213. Ruby 3.3 is in the security maintenance phase. As an exception, this release also includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on. P…
Ruby 3.4.12 Released
Ruby 3.4.12 has been released. This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release also includes other bugfixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.12.tar.gz SIZE: 22498017 SHA1: 8ead0b008d7cdeb543282489e7574324ab62939f SHA256: 5e5d85ad93b0adcccbad47733680f4892…
Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby. Background GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with Regexp.new . GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab serv…
Ruby 4.0.9 Released
Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation that GitLab’s CVE-2026-110264 relies on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.tar.gz SIZE: 23946524 SHA1: 39f31360bc0c03bde9eec4177e443f6298481e2e SHA256: c35350682ff050b79702d57ade4516e7336063f510155d19fb2fb5b3f3909511 SHA512: 9adb0069a07ee1348a04b627d8af1c9f2b6537bdea5dce0b57423…
8月27日(木)
Security advisories: CVE-2026-80212 and CVE-2026-80213
Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213 . We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of m…
7月16日(木)
Ruby 3.3.12 Released
Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242. Please see the release notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these fixes. Please see the GitHub releases for furth…
6月30日(火)
Ruby 3.4.10 Released
Ruby 3.4.10 has been released. This release is a regular stable package release contains the version update of bundled gem net-imap. The net-imap.gem update contains some security fixes. Please see the release note of net-imap v0.5.15 for the detailed update of net-imap.gem. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz SIZE: 22476870 SHA1: 5eac73bce00e770e19b50b69032578df9b2bb41c SHA256: ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec SHA512: 493c9be80a78a4ddf983620295c79ae9f1c8e4c60da8237e12965fa6f95…
5月20日(水)
Ruby 4.0.5 Released
Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065] . Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.6 will be released in July, 4.0.7 in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than plann…
CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler
A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…