Ruby 4.0.3 has been released. This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316 . If your application calls Marshal.load on untrusted data AND has both erb and activesupport loaded, please update your ERB to 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later.