Ruby releases close regex flaws linked to critical GitLab RCEs

Ruby updates address regex-engine memory corruption

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to correct three defects in Onigmo, the regular-expression engine built into the language. The issues were behind four critical remote-code-execution vulnerabilities GitLab patched between September 23 and October 21.

The exposure is not limited to GitLab. Ruby said an application is affected when it compiles a regular expression from text controlled by an attacker. A specially crafted pattern can corrupt memory while Ruby compiles it, potentially enabling code execution on the application’s server.

Dynamic compilation can occur through Regexp.new, Regexp.union or Regexp.compile, as well as interpolation such as /#{input}/. Applications that use only patterns written by their own developers are not affected by this condition.

Upgrade paths and mitigation limits

Ruby 4.0 users should move to 4.0.9, Ruby 3.4 users to 3.4.12, and Ruby 3.3 users to 3.3.13. Ruby stressed that 4.0.8, released in the same week, lacks the correction for CVE-2026-110264 and should not be treated as a complete fix.

Ruby 3.2 and earlier will not receive patches. Version 3.2 reached end of life on April 1, 2026, with 3.2.11 as its final release, and Ruby recommends migration to 3.4 or 4.0. For teams that cannot upgrade immediately, the stated workaround is to stop compiling regexes from untrusted input.

Two commonly assumed controls are insufficient: setting Regexp.timeout does not stop these bugs, and limiting pattern length is unreliable because short patterns can trigger them. That distinction matters for applications that have treated user-supplied regular expressions primarily as a denial-of-service concern.

GitLab impact and administrator actions

GitLab compiles user-provided patterns, including patterns in CI/CD configuration. Its four fixes address crafted expressions that could corrupt memory during Ruby compilation. The first two vulnerabilities, disclosed September 23, required an authenticated account and were rated 9.9. CVE-2026-97229, disclosed October 12, and CVE-2026-110264, disclosed October 21, require no account and carry a 10.0 rating.

CVE-2026-110264 affects GitLab releases from version 7.0 onward. GitLab shipped a fix on October 21 and backported it through versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already patched, while GitLab Dedicated tenants on recent internal releases require no action. Self-managed administrators can also use GitLab’s published detection rules to look for exploitation attempts.

Ruby has not requested separate CVE identifiers for its fixes, at least for now, and advises users to track the four GitLab CVEs. This can leave version-based vulnerability scanning without a direct Ruby match because GitLab’s CVE records identify GitLab as the affected product. Businesses should therefore verify Ruby runtime versions and dynamic-regex use directly, while self-managed GitLab operators should install the applicable patched GitLab release and review available detection rules.