最新のセキュリティ情報
直近24時間の緊急情報
- Critical PHP Security ReleaseWordPress Security News
- PHP critical vulnerability response updatesLaravel Blog
10月12日(月)
Ruby 4.1.0-preview1 Released
We are pleased to announce the release of Ruby 4.1.0-preview1. Ruby 4.1 introduces Ractor local GC, Windows support of YJIT, autoload_relative, and adds many improvements. Ractor improvements A lot of work has gone into making Ractors more stable, performant, and usable. These improvements bring Ractor implementation closer to leaving experimental status. The default GC now runs per Ractor : each Ractor collects its own heap on its own thread without stopping the others, and a stop-the-world collection only runs when it is really needed (explicit full GC.start , shareable-object growth, recla…
9月23日(水)
Ruby 3.4.11 Released
Ruby 3.4.11 has been released. This is a regular scheduled update release includes bugfixes. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.gz SIZE: 22492449 SHA1: ed687c91e79b20a755666adbc290695accd49d79 SHA256: 5c22be44524312b3d433d68739bcc530633b1da5ef8ba0afa0a37680da17d3de SHA512: cb951af61fb237ddf3213f5efec893a50524216800359514baded26189a5aa1640cc83e344aedd001cc57c4479cfabcf20033be77c28401333f57f2ac13c6640 https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.xz SIZE: 16712500 SHA1: c36b1142f3d45441edbe0bb9146ddda3…
9月15日(火)
Ruby 4.0.7 Released
Ruby 4.0.7 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.8 will be released in November. If a change arises that significantly affects users, a release may occur earlier than planned. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.7.tar.gz SIZE: 23937964 SHA1: 730d4f8cebb60a1f5b556e7b58d86d0301772558 SHA256: 911ace20f90d068ca0e4dda6d0e4f0f81e52e52f2dd4f4004c72…
8月27日(木)
Security advisories: CVE-2026-80212 and CVE-2026-80213
Two vulnerabilities have been discovered in the resolv gem bundled with Ruby. They have been assigned the CVE identifiers CVE-2026-80212 and CVE-2026-80213 . We recommend upgrading the resolv gem. CVE-2026-80212: Memory exhaustion through malicious DNS responses An application that resolves a hostname an attacker can influence, such as a webhook target or a user-supplied URL, can be made to consume memory without bound. The attacker points a domain at a name server they control and returns responses that the library retains permanently. Repeated lookups grow the process until it runs out of m…
7月16日(木)
Ruby 3.3.12 Released
Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25. The net-imap update fixes CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-47240, CVE-2026-47241 and CVE-2026-47242. Please see the release notes of net-imap v0.4.24 and net-imap v0.4.25 for the details of these fixes. Please see the GitHub releases for furth…
7月14日(火)
Ruby 4.0.6 Released
Ruby 4.0.6 has been released. This is a routine update that includes bugfixes. Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent release. Ruby 4.0.7 will be released in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.6.tar.gz SIZE: 23904779 SHA1: bd2b5a5bdf0ac9947eab242f41…
6月30日(火)
Ruby 3.4.10 Released
Ruby 3.4.10 has been released. This release is a regular stable package release contains the version update of bundled gem net-imap. The net-imap.gem update contains some security fixes. Please see the release note of net-imap v0.5.15 for the detailed update of net-imap.gem. Please see the GitHub releases for further details. Download https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.10.tar.gz SIZE: 22476870 SHA1: 5eac73bce00e770e19b50b69032578df9b2bb41c SHA256: ecee2d072a14f2d14347dd56dfd8fe5c3130abf5117bfaacbda0f4ef9cc429ec SHA512: 493c9be80a78a4ddf983620295c79ae9f1c8e4c60da8237e12965fa6f95…
5月20日(水)
Ruby 4.0.5 Released
Ruby 4.0.5 has been released. This release only contains a security fix for CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler and a build system regression in Ruby 4.0.4 under C locale [Bug #22065] . Please see the GitHub releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.6 will be released in July, 4.0.7 in September, and 4.0.8 in November. If a change arises that significantly affects users, a release may occur earlier than plann…
CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler
A use-after-free vulnerability has been discovered in the pthread-based getaddrinfo timeout handler of Ruby. This vulnerability has been assigned the CVE identifier CVE-2026-46727 . This issue has been fixed in Ruby 4.0.5. We recommend upgrading Ruby. Details A race condition exists in the timeout cancellation path of rb_getaddrinfo used by Addrinfo.getaddrinfo(..., timeout:) and Socket.tcp(..., resolv_timeout:) . A remote attacker who can delay DNS responses near the specified timeout may cause the Ruby process to dereference freed memory and crash. Recommended action Please update to Ruby 4…
5月12日(火)
Ruby 4.0.4 Released
Ruby 4.0.4 has been released. This is a routine update that includes bugfixes. Please see the GitHub Releases for further details. Release Schedule We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.5 will be released in July, 4.0.6 in September, and 4.0.7 in November. If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly. Download https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.4.tar.gz SIZE: 23816838 SHA1: 363…