Ruby Patches Regex Engine Bugs Behind Four Critical GitLab Flaws

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. GitLab fixed each flaw by shipping a patched Ruby.

Ruby says the problem goes beyond GitLab. An application is affected only if it compiles a regular expression from a string an attacker controls, for example by passing it to Regexp.new, Regexp.union or Regexp.compile, or by placing it in a pattern through interpolation. Apps that only use patterns written by their own developers are not affected. The first two GitLab flaws, disclosed on September 23, need a logged-in account and were rated 9.9 out of 10. The two from October need no account and were rated 10.0. One of them, CVE-2026-110264, reaches every GitLab version from 7.0 onward. As of October 23, none was listed in CISA's Known Exploited Vulnerabilities catalog.

Ruby 4.0 users should install 4.0.9, because 4.0.8 lacks one of the fixes. Ruby 3.2 and earlier will get no fix, as 3.2 reached end of life on April 1, 2026; Ruby recommends moving to 3.4 or 4.0. If you cannot upgrade yet, stop compiling regular expressions from untrusted input. Setting Regexp.timeout does not stop these bugs, and capping pattern length is unreliable because short patterns can trigger them.