{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs · updates",
  "home_page_url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves",
  "feed_url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves/feed.json",
  "description": "Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.",
  "language": "en",
  "_pwn": {
    "slug": "ruby-regexp-compilation-fixes-gitlab-cves",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves/feed.xml",
    "llms": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves/llms.txt",
    "json": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-23-16090c0b",
      "url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-23-16090c0b",
      "title": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: Ruby releases 4.0.9, 3.4.12 and 3.3.13 with the upstream fixes: a double free when parsing fails after an alternation (#13332), an integer overflow in the compiled pattern size (#19020) and an overflow of internal IDs in patterns with many repeats (#16801). Ruby requested no CVEs of its own and says to track GitLab's IDs in scanners. Credit: Johan Carlsson (joaxcar) via GitLab's bug bounty; GitLab reported and coordinated.",
      "content_text": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: Ruby releases 4.0.9, 3.4.12 and 3.3.13 with the upstream fixes: a double free when parsing fails after an alternation (#13332), an integer overflow in the compiled pattern size (#19020) and an overflow of internal IDs in patterns with many repeats (#16801). Ruby requested no CVEs of its own and says to track GitLab's IDs in scanners. Credit: Johan Carlsson (joaxcar) via GitLab's bug bounty; GitLab reported and coordinated.\n\nSource: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/",
      "date_published": "2026-10-23T00:00:00.000Z",
      "external_url": "https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-23-935f27da",
      "url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-23-935f27da",
      "title": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: Ruby 3.3 is in security maintenance and gets the Regexp fixes as an exception. 3.3.13 also updates the default resolv gem to 0.3.2, fixing CVE-2026-80212 and CVE-2026-80213.",
      "content_text": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: Ruby 3.3 is in security maintenance and gets the Regexp fixes as an exception. 3.3.13 also updates the default resolv gem to 0.3.2, fixing CVE-2026-80212 and CVE-2026-80213.\n\nSource: https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/",
      "date_published": "2026-10-23T00:00:00.000Z",
      "external_url": "https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-21-be522dca",
      "url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-21-be522dca",
      "title": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.5.1 and backports fix CVE-2026-110264 (CVSS 10.0, unauthenticated RCE from an integer overflow when compiling a crafted regex), affecting every CE/EE version from 7.0.",
      "content_text": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.5.1 and backports fix CVE-2026-110264 (CVSS 10.0, unauthenticated RCE from an integer overflow when compiling a crafted regex), affecting every CE/EE version from 7.0.\n\nSource: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/",
      "date_published": "2026-10-21T00:00:00.000Z",
      "external_url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-12-888dcb10",
      "url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-12-888dcb10",
      "title": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.4.2 fixes CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via a crafted CI/CD regex); Rapid7 shows the 19.4.1 repeat-bound check could be bypassed with an inline regex comment and built a working PoC against 19.4.1.",
      "content_text": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.4.2 fixes CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via a crafted CI/CD regex); Rapid7 shows the 19.4.1 repeat-bound check could be bypassed with an inline regex comment and built a working PoC against 19.4.1.\n\nSource: https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/",
      "date_published": "2026-10-12T00:00:00.000Z",
      "external_url": "https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-09-23-025b4406",
      "url": "https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-09-23-025b4406",
      "title": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.4.1 fixes CVE-2026-89078 (double free in its regex parser, CVSS 9.9, authenticated RCE via CI/CD config) and CVE-2026-93577 (integer overflow in the regex compiler) by patching the Ruby it ships.",
      "content_text": "Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.4.1 fixes CVE-2026-89078 (double free in its regex parser, CVSS 9.9, authenticated RCE via CI/CD config) and CVE-2026-93577 (integer overflow in the regex compiler) by patching the Ruby it ships.\n\nSource: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/",
      "date_published": "2026-09-23T00:00:00.000Z",
      "external_url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/",
      "tags": [
        "critical"
      ]
    }
  ]
}