Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to patch three bugs in its Onigmo regular expression engine. These bugs were responsible for four critical Remote Code Execution (RCE) flaws that GitLab patched over the past month. GitLab discovered that a specially crafted pattern could corrupt memory during Ruby's compilation process, potentially leading to code execution.
Ruby warns that any application building a regular expression from untrusted input is affected, not just GitLab. The vulnerability occurs when an attacker-controlled string is compiled into a regular expression via Regexp.new, Regexp.union, Regexp.compile, or pattern interpolation like /#{input}/. Applications that only use pre-written regular expressions are not at risk.
Ruby fixed the three bugs in versions 4.0.9, 3.4.12, and 3.3.13, with 3.4.12 and 3.3.13 being the first releases in their series to contain the necessary fixes. An earlier release, 4.0.8, does not include the fix for one of the flaws (CVE-2026-110264), so users on version 4.0 should install 4.0.9. Ruby 3.2 and earlier will not receive a fix, as Ruby 3.2 reached its end-of-life date on April 1, 2026.
Ruby advises upgrading to version 3.4 or 4.0, or stopping the compilation of regular expressions from untrusted input, although neither of these defenses is entirely effective. GitLab, which compiles regular expressions supplied by its users, discovered the vulnerability and issued four CVEs between September 23 and October 21. The first two CVEs, disclosed on September 23, required a logged-in account and were rated 9.9 out of 10, while the two from October, CVE-2026-97229 and CVE-2026-110264, required no account and had a maximum rating of 10.0.
CVE-2026-110264 affects all GitLab versions from 7.0 onward. No CVE identifiers have been assigned to these fixes by Ruby yet, so users should track the issues using the GitLab CVE numbers instead. Self-managed GitLab instances need to install the release that fixes CVE-2026-110264, while GitLab.com and recent internal releases already run the patched version.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
