Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs
Ruby (CRuby / Onigmo regex engine)
Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.
Why this severity: GitLab rates the CVEs critical: CVSS 3.1 10.0 for CVE-2026-97229 and CVE-2026-110264 (unauthenticated RCE), 9.9 for CVE-2026-89078 (authenticated). Ruby assigned no CVEs or score of its own; plain Ruby apps are only exposed if they compile regexes from untrusted strings. No exploitation reported.
- Started
- Oct 23, 2026
Affected
- Ruby 4.0 before 4.0.9
- Ruby 3.4 before 3.4.12
- Ruby 3.3 before 3.3.13
- Ruby 3.2 and older: end-of-life (3.2 since 2026-04-01), no fixed release
- Only apps that compile a regular expression from an attacker-controlled string
Fixed in
- 4.0.9
- 3.4.12
- 3.3.13
Timeline5
Ruby releases 4.0.9, 3.4.12 and 3.3.13 with the upstream fixes: a double free when parsing fails after an alternation (#13332), an integer overflow in the compiled pattern size (#19020) and an overflow of internal IDs in patterns with many repeats (#16801). Ruby requested no CVEs of its own and says to track GitLab's IDs in scanners. Credit: Johan Carlsson (joaxcar) via GitLab's bug bounty; GitLab reported and coordinated.
Ruby 3.3 is in security maintenance and gets the Regexp fixes as an exception. 3.3.13 also updates the default resolv gem to 0.3.2, fixing CVE-2026-80212 and CVE-2026-80213.
GitLab 19.5.1 and backports fix CVE-2026-110264 (CVSS 10.0, unauthenticated RCE from an integer overflow when compiling a crafted regex), affecting every CE/EE version from 7.0.
GitLab 19.4.2 fixes CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via a crafted CI/CD regex); Rapid7 shows the 19.4.1 repeat-bound check could be bypassed with an inline regex comment and built a working PoC against 19.4.1.
GitLab 19.4.1 fixes CVE-2026-89078 (double free in its regex parser, CVSS 9.9, authenticated RCE via CI/CD config) and CVE-2026-93577 (integer overflow in the regex compiler) by patching the Ruby it ships.
Advisories8
- Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264Ruby · Oct 23, 2026
- Ruby 4.0.9 ReleasedRuby · Oct 23, 2026
- Ruby 3.4.12 ReleasedRuby · Oct 23, 2026
- Ruby 3.3.13 ReleasedRuby · Oct 23, 2026
- Ruby Maintenance BranchesRuby
- GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13GitLab · Oct 21, 2026
- GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8GitLab · Oct 12, 2026
- GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7GitLab · Sep 23, 2026
News & write-ups1
Posts1
We released Ruby 4.0.9, 3.4.12, and 3.3.13, and published an announcement about Regexp compilation fixes. t.co/zTemAPrS2A If your application compiles a regular expression from an untrusted string, please update your Ruby to one of those versions.
Notes & caveats
CVE IDs are GitLab's (CNA GitLab); Ruby has not requested its own CVEs and may update its page. Fix-to-CVE mapping and first fixed release per branch from ruby-lang.org. Related: /i/gitlab-cve-2026-110264-regex-rce.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
