RUBY has issued security fixes in versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs in Onigmo, the regular expression engine embedded in the language. The flaws underpin four critical GitLab RCE (remote code execution) flaws that were patched during September and October 2026.
GitLab’s incident timeline shows the first two flaws disclosed on 23 September required a logged‑in account and were rated 9.9/10, while two later flaws disclosed on 12 and 21 October did not require an account and carried the maximum CVSS score of 10.0. One of the fixes, CVE-2026-110264, affects every GitLab version from 7.0 onward; 4.0.8 did not include this particular fix, so users on 4.0 should upgrade to 4.0.9.
Ruby notes that Ruby 3.2 and earlier will not receive patches, and that users should move to 3.4 or 4.0, with a specific advisory urging administrators to stop compiling regular expressions from untrusted input if upgrading is not yet feasible.
The advisory clarifies that any application which builds a regular expression from a string under an attacker’s control is affected—via Regexp[.]new, Regexp[.]union, Regexp[.]compile, or interpolation into a pattern such as /#{input}/—while those only using regexes written by their own developers are unaffected. Ruby emphasises that two mitigation approaches—Regexp[.]timeout and pattern length capping—do not reliably block these bugs.
GitLab’s patches were backported to multiple release lines (including 18.11.13 and 19.x series), and GitLab has provided detection rules to help identify exploitation attempts. Ruby has not yet assigned CVEs of its own for these fixes, instead directing users to track through GitLab’s listed CVEs.