Notice regarding recently-reported Ruby regular expression vulnerabilities (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)

What to do

• Check whether your product depends on Cloudinary. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-10-24 07:03 UTC and 2026-10-24 07:03 UTC may need a replay.

• Subscribe to Cloudinary's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=cloudinary works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Cloudinary 1

1. resolvedOct 24, 2026, 7:03 AM UTC

   On October 23, 2026, the Ruby project released security fixes for vulnerabilities in its regular expression engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). Cloudinary upgraded its core platform, including its upload, transformation, and delivery APIs and Console, to the patched Ruby version on the same day. Our review found no evidence of exploitation and no impact on customers or customer data. No action is required on your part for the Cloudinary platform. Customers who use Ruby in their own applications, including with the Cloudinary Ruby SDK, should update Ruby in their environments to a patched release (3.3.13, 3.4.12, 4.0.9 or later).

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.