Cloudinary incident
Notice regarding recently-reported Ruby regular expression vulnerabilities (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)
Resolved on October 24, 2026.
On October 23, 2026, the Ruby project released security fixes for vulnerabilities in its regular expression engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). Cloudinary upgraded its core platform, including its upload, transformation, and delivery APIs and Console, to the patched Ruby version on the same day. Our review found no evidence of exploitation and no impact on customers or customer data. No action is required on your part for the Cloudinary platform. Customers who use Ruby in their own applications, including with the Cloudinary Ruby SDK, should update Ruby in their environments to a patched release (3.3.13, 3.4.12, 4.0.9 or later).
Update timeline
- resolved Oct 24, 2026, 07:03 AM UTC
On October 23, 2026, the Ruby project released security fixes for vulnerabilities in its regular expression engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). Cloudinary upgraded its core platform, including its upload, transformation, and delivery APIs and Console, to the patched Ruby version on the same day. Our review found no evidence of exploitation and no impact on customers or customer data. No action is required on your part for the Cloudinary platform. Customers who use Ruby in their own applications, including with the Cloudinary Ruby SDK, should update Ruby in their environments to a patched release (3.3.13, 3.4.12, 4.0.9 or later).
Your product runs on more than Cloudinary
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services