Back www.ruby-lang.org

Ruby 3 3 13 Released

www.ruby-lang.org • October 23, 2026

Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264

This release updates the default gem resolv to 0.3.2, which fixes CVE-2026-80212 and CVE-2026-80213.

Ruby 3.3 is in the security maintenance phase. As an exception, this release also includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on.

Please see the GitHub releases for further details.

SIZE: 21497008 SHA1: e89379c35cd61b23c7fef6cff9c5bbece4e2c391 SHA256: 4cae72e971bd1cdb20ca87d299111182417c5276c162de8ead0ab0531426cd61 SHA512: 0536341f6f612a1eb0128f7d18eed081b09264c695e6a159a5456ba3050464849791ae26e33a7ea384406fa9e19b98bf194c89638dfe2940d3dbeed5b3126c92

SIZE: 15878972 SHA1: 61e8a88d601ca7a4e9f9c30428fa46be0fdf690d SHA256: 6bd764359992373a96556b45fb7dfe6b6170da34a0a2fd0b7e1be7932fea982b SHA512: 906e270e2629b44e469265e08d693f996b467a3fc165fbdb9b8f6f7b37effe4fdae9d4968e72a809d1381e35279cb10b6630d40fac31a634981deb4c30ff325c

SIZE: 26961541 SHA1: 4536403d0c1feaa6290fc7d94e65db4bc2b7f0ed SHA256: 8cf1c468af6dbcaa2c48270cc4c951325dabe5fd84b609641d4bd7b89c9d5766 SHA512: 622c8b60b2202aea1aa4caed00cee5984109926793ee57c86a9cc39b1628855f51a26d07258aa85aacc679c6186efc4ebf20b5a51f199de7cdd6fcc98a212d10

Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Regexp Vulnerabilities in Ruby Releases Addressed On October 23, 2026, multiple Ruby versions were released to address vulnerabilities related to Regexp compilation. These include CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264, all of which have a CVSS score of 9.9 or higher. The vulnerabilities could potentially allow attackers to exploit systems using affected Ruby versions. The releases include Ruby 3.3.13, Ruby 3.4.12, and Ruby 4.0.9, each containing fixes for these vulnerabilities. CVE-2026-110264 was published just a day prior to the release, indicating a rapid response to a newly disclosed issue. Users are encouraged to update their Ruby installations to mitigate the risks associated with these vulnerabilities. The patches are now available on GitHub for all affected versions. 73

Extracted Entities

Ruby 3 3 13 Released

The full story

Extracted Entities

CVEs (6)

SHA1 Hashes (3)

SHA256 Hashes (3)