Is Ruby 2.3.8 patched?

Ruby · cycle 2.3 · end of life · Official site ↗

2.3.829/100End of life

Current stable (4.0.5): 100/100

Minimum safe version2.7.7

2.3.8 has 7 open critical-or-high vulnerabilities. Run 2.7.7 or later to clear them. See what 2.7.7 fixes →

Health score29/100

Open issues10

Exploited now0

Cycle 2.3 EOL2019-03-31

Latest release4.0.5

Summary iPlain-English security status for Ruby 2.3.8, built from its CVEs, active-exploitation data, end-of-life date and latest release.

Ruby 2.3.8 is part of the 2.3 release line. 10 known vulnerabilities affect it. The minimum safe version is 2.7.7 — upgrade to it or later to clear the open critical/high issues. The 2.3 line reached end-of-life on 2019-03-31, so it no longer receives security patches. The latest supported Ruby release is 4.0.5.

Known issues affecting 2.3.8

Exploited first, then by exploitation probability.

CVE-2021-28966 HIGH EPSS 58% → fixed in 3.0.1 CVE-2017-9229 HIGH EPSS 5% → see advisory CVE-2021-28965 HIGH EPSS 5% → fixed in 3.0.1 CVE-2022-28739 HIGH EPSS 4% → fixed in 3.1.2 CVE-2020-25613 HIGH EPSS 4% → see advisory CVE-2015-9096 MEDIUM EPSS 4% → see advisory CVE-2017-9225 CRITICAL EPSS 3% → see advisory CVE-2021-31810 MEDIUM EPSS 3% → see advisory CVE-2021-41819 HIGH EPSS 3% → fixed in 3.0.3 CVE-2023-28756 MEDIUM EPSS 2% → see advisory

Other Ruby versions

Check another release line of Ruby.

Ruby 4.0.5 Ruby 3.4.9 Ruby 3.3.11 Ruby 3.2.11 Ruby 3.1.7 Ruby 3.0.7 Ruby 2.7.8 Ruby 2.6.10 Ruby 2.5.9 Ruby 2.4.10 Ruby 2.2.10 Ruby 2.1.10 Ruby 2.0.0p648 Ruby 1.9.3p551

Frequently asked

Is Ruby 2.3.8 patched?

Ruby 2.3.8 is end-of-life and no longer receives security patches. Move to 4.0.5.

What version should I upgrade Ruby 2.3.8 to?

Upgrade Ruby 2.3.8 to at least 2.7.7 to clear its 7 open critical-or-high vulnerabilities.

When does Ruby 2.3 reach end-of-life?

Ruby 2.3 reached end-of-life on 2019-03-31 and no longer receives security patches.

What is the latest version of Ruby?

The latest supported Ruby release is 4.0.5.

Is Ruby 2.3.8 still receiving security updates?

No — Ruby 2.3.8 is on the 2.3 line, which reached end-of-life on 2019-03-31 and no longer receives security updates. Upgrade to 4.0.5 or later to stay supported.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Ruby's official advisory before you patch or upgrade — Ruby official site ↗