Ruby Patches Three Onigmo Bugs Behind Four Critical GitLab Flaws

Summary

Ruby 4.0.9, 3.4.12, and 3.3.13 fix three Onigmo bugs behind four critical GitLab flaws. Apps compiling attacker-controlled regex patterns are affected; Ruby 3.2 and earlier will not receive fixes.

Key points

Crafted regular-expression patterns can corrupt memory during compilation and potentially enable code execution.
Applications are affected when they compile attacker-controlled patterns using Regexp.new, Regexp.union, Regexp.compile, or interpolation; developer-written patterns are not affected.
Ruby fixed the bugs in versions 4.0.9, 3.4.12, and 3.3.13. Ruby 4.0 users should use 4.0.9 because 4.0.8 missed the CVE-2026-110264 fix.
Ruby 3.2 and earlier will not receive fixes. Until upgrading, Ruby advises stopping compilation of regular expressions from untrusted input; Regexp.timeout and pattern-length limits are not reliable defenses.
Two October GitLab flaws, including CVE-2026-97229 and CVE-2026-110264, require no account and were rated 10.0; the earlier September flaws require a logged-in account and were rated 9.9.
As of October 23, none of the four GitLab CVEs was listed in CISA's Known Exploited Vulnerabilities catalog. Ruby had not requested separate CVE identifiers for its fixes.
Self-managed GitLab administrators need a release fixing CVE-2026-110264; GitLab also published detection rules for signs of exploitation attempts.

Article Details

Vulnerability Types: Memory corruption during regular-expression compilation
Potential code execution
Severity: Critical; GitLab rated the first two flaws 9.9/10 and the October flaws 10.0/10.
Affected Versions: GitLab 7.0 onward (CVE-2026-110264)
Exploitation Status: unknown
Exploit Availability: unknown
Patch Status: available
Workarounds: Stop compiling regular expressions from untrusted input.