Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs ยท updates https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix. en Fri, 23 Oct 2026 00:00:00 GMT Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: Ruby releases 4.0.9, 3.4.12 and 3.3.13 with the upstream fixes: a double free when parsing fails after an alternation (#13332), an integer overflow in the compiled pattern size (#19020) and an overflow of internal IDs in patterns with many repeats (#16801). Ruby requested no CVEs of its own and says to track GitLab's IDs in scanners. Credit: Johan Carlsson (joaxcar) via GitLab's bug bounty; GitLab reported and coordinated. https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-23-16090c0b Fri, 23 Oct 2026 00:00:00 GMT critical <p><a href="https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/">Source</a></p> Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: Ruby 3.3 is in security maintenance and gets the Regexp fixes as an exception. 3.3.13 also updates the default resolv gem to 0.3.2, fixing CVE-2026-80212 and CVE-2026-80213. https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-23-935f27da Fri, 23 Oct 2026 00:00:00 GMT critical <p><a href="https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/">Source</a></p> Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.5.1 and backports fix CVE-2026-110264 (CVSS 10.0, unauthenticated RCE from an integer overflow when compiling a crafted regex), affecting every CE/EE version from 7.0. https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-21-be522dca Wed, 21 Oct 2026 00:00:00 GMT critical <p><a href="https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/">Source</a></p> Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.4.2 fixes CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via a crafted CI/CD regex); Rapid7 shows the 19.4.1 repeat-bound check could be bypassed with an inline regex comment and built a working PoC against 19.4.1. https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-10-12-888dcb10 Mon, 12 Oct 2026 00:00:00 GMT critical <p><a href="https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/">Source</a></p> Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs: GitLab 19.4.1 fixes CVE-2026-89078 (double free in its regex parser, CVSS 9.9, authenticated RCE via CI/CD config) and CVE-2026-93577 (integer overflow in the regex compiler) by patching the Ruby it ships. https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves#2026-09-23-025b4406 Wed, 23 Sep 2026 00:00:00 GMT critical <p><a href="https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/">Source</a></p>