Ruby Fixes Three Regex Engine Bugs Behind Four Critical GitLab RCE Flaws

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13, fixing three bugs in Onigmo, the regular expression engine built into the language. Those bugs sat behind four critical security flaws that GitLab patched over the past month.

GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on the server.

Who Is Affected

Ruby's advisory is specific: an application is only at risk if it compiles a regular expression from a string an attacker controls. That happens when such a string is passed to Regexp.new, Regexp.union or Regexp.compile, or interpolated into a pattern, as in /#{input}/. Programs that only use expressions written by their own developers are not affected.

The 3.4.12 and 3.3.13 releases are the first in their series to carry any of the three fixes. Users on 4.0 need 4.0.9 specifically: the 4.0.8 release from the same week lacks the fix for CVE-2026-110264. Ruby 3.2 and earlier will get nothing — 3.2 reached end of life on April 1, 2026 — and the advice is to move to 3.4 or 4.0.

If you cannot upgrade yet, the only workaround is to stop compiling regular expressions from untrusted input. Two defenses that look helpful are not: Regexp.timeout does not stop these bugs, and capping a pattern's length is unreliable, since short patterns can trigger them too.

How It Reached GitLab

GitLab compiles regular expressions supplied by its users, such as the patterns in a CI/CD configuration. Crafted patterns corrupted memory during compilation, and between September 23 and October 21 the company issued four CVEs, closing each by shipping a patched Ruby.

The first two, disclosed on September 23, each required a logged-in account and were rated 9.9 out of 10. The October pair — CVE-2026-97229 on the 12^th and CVE-2026-110264 on the 21^st — need no account and were rated the maximum 10.0. CVE-2026-110264 reaches every GitLab version from 7.0 onward. A researcher using the handle joaxcar reported all four through GitLab's bug bounty program; as of October 23, none appeared in CISA's Known Exploited Vulnerabilities catalog.

No Ruby CVE, For Now

Ruby has not requested CVE identifiers of its own — "at least for now" — and told users to track the issues by GitLab's four CVE numbers. That leaves a gap for anyone scanning by CVE: GitLab's records name only GitLab as the affected product, so a scanner has nothing to match against an installed Ruby version. Ruby had assigned CVEs to similar fixes in 2022 and 2024.

Self-managed GitLab instances need the build that fixes CVE-2026-110264, shipped on October 21 and backported as far as 18.11.13. Because GitLab bundles its own copy of Ruby, installing a fixed release applies the patch. GitLab.com already runs the patched version.

Source: The Hacker News