Provider
CloudinaryIncident detail
Notice regarding recently-reported Ruby regular expression vulnerabilities (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)
Resolved incidentMinor
Timeline window
to
Get alerted the next time Cloudinary breaks
Free email alerts for the handful of vendors you cannot afford to miss. No card, live in about a minute. Paid plans add Slack, Teams, Discord, and webhook delivery across your whole stack, plus higher API quotas.
Timeline
Incident updates
Every update on the official status source, oldest to newest, exactly as it appeared there.
Resolved
On October 23, 2026, the Ruby project released security fixes for vulnerabilities in its regular expression engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264).
Cloudinary upgraded its core platform, including its upload, transformation, and delivery APIs and Console, to the patched Ruby version on the same day. Our review found no evidence of exploitation and no impact on customers or customer data. No action is required on your part for the Cloudinary platform.
Customers who use Ruby in their own applications, including with the Cloudinary Ruby SDK, should update Ruby in their environments to a patched release (3.3.13, 3.4.12, 4.0.9 or later).
Keep exploring
More from Cloudinary
Neighboring incidents on Cloudinary's timeline and the rest of their record on OutageDeck.