---
title: "Crystal 1.20.3 is released!"
url: https://daily.dev/posts/crystal-1-20-3-is-released--fkooxihe1
source_url: https://crystal-lang.org/2027/07/02/1.20.3-released
type: article
source: "Crystal"
published: 2026-07-03T09:00:04.770Z
updated: 2026-07-03T09:00:21.009Z
tags: ["security"]
reading_time: 2
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Crystal 1.20.3 is released!

**[Crystal](https://daily.dev/sources/crystallang)** · 2 min read · 1 upvotes · 0 comments

## Summary

Crystal 1.20.3 is a security patch release fixing two vulnerabilities in the YAML parsers. The first fix adds a maximum nesting depth limit to prevent stack overflows from deeply nested YAML documents. The second fix addresses the 'billion laughs' alias expansion attack by adding an alias-to-anchor ratio check, preventing exponential node expansion that could severely slow down applications. Upgrading is recommended for any application that processes YAML from untrusted sources.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://crystal-lang.org/2027/07/02/1.20.3-released>

## Similar posts on daily.dev

- [Crystal 1.20.1 is released\!](https://daily.dev/posts/crystal-1-20-1-is-released--kocd2upnl) · Crystal · 66 upvotes · 2 comments
- [Crystal 1.19.2 is released\!](https://daily.dev/posts/crystal-1-19-2-is-released--kdscgsowv) · Crystal · 0 upvotes · 0 comments
- [Crystal 1.20.2 is released\!](https://daily.dev/posts/crystal-1-20-2-is-released--bpd4yqred) · Crystal · 54 upvotes · 3 comments

---

Tags: [#security](https://daily.dev/tags/security)

[View this post on daily.dev](https://daily.dev/posts/crystal-1-20-3-is-released--fkooxihe1)