Ruby fixes regex flaws that could enable GitLab server attacks

On 23 October 2026 the Ruby team released security updates in versions 4.0.9, 3.4.12 and 3.3.13 to fix memory bugs in Onigmo, Ruby’s regular expression engine. GitLab researchers had determined that these bugs could enable remote code execution on affected servers and assigned four CVEs to the flaws.

The CVEs are CVE-2026-110264, CVE-2026-97229, CVE-2026-89078 and CVE-2026-93577; the advisory lists the highest severity as CVSSv3 score 10.0 for two of the flaws and 9.9 for the others, with two requiring no login and two needing an authenticated user. The article notes there has been no confirmed exploitation in the wild at the time of reporting, and patches are available.

Exploitation stems from how GitLab compiles user-supplied regular expressions, such as patterns in CI configuration, using Regexp[.]new. The Ruby advisory explains that specially crafted patterns could corrupt memory during compilation. The root causes map to: (1) a double free when parsing fails after an alternation (CVE-2026-89078); (2) an integer overflow in a compiled pattern size (CVE-2026-93577 and CVE-2026-97229); (3) an overflow of internal IDs in patterns with many repeats (CVE-2026-110264).

Affected applications are those that compile a regex from untrusted input, including Regexp[.]new, Regexp[.]union, Regexp[.]compile and interpolated literals; developer-written patterns are not affected. Ruby notes that Regexp[.]timeout does not protect against these bugs, and short patterns can still trigger flaws. To mitigate, upgrade Ruby to 4.0.9, 3.4.12 or 3.3.13 and update GitLab to the latest patch. If upgrading is not possible, avoid compiling regexes from untrusted input.