CVE-2026-41316

Coverage

Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++16 Jul, 05:08
Ruby 3.3.12 Released
Ruby 3.3.12 has been released. This release includes security fixes. Please check the topics below for details. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class This release updates the default gem erb to 4.0.3.1 and the bundled gem net-imap to 0.4.25…
ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-re…(opens the publisher's site in a new tab)
Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++21 Apr, 08:45
Ruby 4.0.3 Released
Ruby 4.0.3 has been released. This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316. If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. You may use this Ruby 4.0.3…
ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-rel…(opens the publisher's site in a new tab)

No signals recorded