| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-09-10 | 1.8 kB | |
| v3.0.37 source code.tar.gz | 2026-09-10 | 178.5 MB | |
| v3.0.37 source code.zip | 2026-09-10 | 181.2 MB | |
| Totals: 3 Items | 359.7 MB | 25 | |
This iteration of BigBlueButton 3.0 contains security fixes only. We encourage administrators to update!
Note, we drop support for SIP.JS audio (/ws) here as part of one of the patches. BigBlueButton 4.0 already had it dropped. A corresponding change in bbb-install.sh (v3.0.x-release branch) was made too.
For those using custom installers, make sure /usr/share/bigbluebutton/nginx/sip.nginx is not being reintroduced!
More details included in the advisories below. Note, if they are not yet public when reading this, check a bit later.
Core
- Cross-meeting audio access via unvalidated voice bridge https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-g92v-3w29-55rh
- Cross-Meeting Presentation Injection Due to an Unbound Upload Token https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9v52-vhvw-4w5c
- Cross Meeting Page IDOR https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-mvx6-hg8v-3x4j
- GetJoinUrl Parameter Injection and Checksum Pollution https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8p8h-cw52-x467
- Improper enforcement of plugin role restrictions on custom chat messages https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-c4v9-6mvh-px5p
Full Changelog: https://github.com/bigbluebutton/bigbluebutton/compare/v3.0.36...v3.0.37
Release name
Passing -v jammy-300 to https://github.com/bigbluebutton/bbb-install/blob/v3.0.x-release/bbb-install.sh will always install the latest released BigBlueButton 3.0 version.
If for some reason you would like to install this specific release, pass -v jammy-300-3.0.37.
We still recommend using -v jammy-300 as this repository is continually updated with each BigBlueButton 3.0 release.
