Ruby 4.0.3 Released

Posted by k0kubun on 21 Apr 2026

Ruby 4.0.3 has been released.

This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316.

If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. You may use this Ruby 4.0.3 release to do so.

Release Schedule

We intend to release the latest stable Ruby version (currently Ruby 4.0) every two months following the most recent regular release. Ruby 4.0.4 will be released in May, 4.0.5 in July, 4.0.6 in September, and 4.0.7 in November.

If a change arises that significantly affects users, a release may occur earlier than planned, and the subsequent schedule may shift accordingly.

Download

• https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.3.tar.gz

  SIZE: 23806898
  SHA1: 619db0f25713a8f007d5889ae6e66ba0d31118e8
  SHA256: 77964acc370d5c8375b9502e5ba6c13c03ef91ab9eb9f521c84fb42b9c9a6b0f
  SHA512: 6fd12620869a9a36fa2e1cce302de42f429ab9e9fae1fe3b0901ca1a1b3a606a83feed87f4b76935beb715e8a750cf718f88afef2de4e866ad574b33abb12dbe
  

• https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.3.tar.xz

  SIZE: 17878572
  SHA1: faf1f3df171d2160116d190ca32b6b00e0338bfa
  SHA256: 22cf6005d25bbe496b5ebe9224d63a1aaabfbfe02591bb5d612517c5a7836f29
  SHA512: 5816fb264ce76df59f4bfe0cadceb45025fada2e61f2c14024d6b03f63d304820cddf94afcf82a4951fd12f3b0d9148683f856f3f2245d56042fc8407b6cbff5
  

• https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.3.zip

  SIZE: 29109899
  SHA1: d19d91723d7a19a34b860eee8544093f64c9d92f
  SHA256: a80f1a3162950cfc1ef70f066132005efbb817f7ab6f16dcc244e5f015aabbc2
  SHA512: 48b18fc578b5d7cd362a549ff5091c749d0460122f5dc3701fd6dada8016253fe0e85c498e20943e1a7f360b1e9fd073939da00df4b0c8a1afdddc16c43e43bc
  

Release Comment

Many committers, developers, and users who provided bug reports helped us make this release. Thanks for their contributions.