# Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs · pwn.watch > Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix. Page: https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves · generated 2026-10-23T13:44:18.354Z ## Status - Severity: critical · status: live · patch: patched - Product: Ruby (CRuby / Onigmo regex engine) - Started: 2026-10-23 - CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 - Affected: Ruby 4.0 before 4.0.9; Ruby 3.4 before 3.4.12; Ruby 3.3 before 3.3.13; Ruby 3.2 and older: end-of-life (3.2 since 2026-04-01), no fixed release; Only apps that compile a regular expression from an attacker-controlled string - Fixed in: 4.0.9; 3.4.12; 3.3.13 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves/feed.xml - JSON Feed: https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves.json - This file: https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves/llms.txt ## Updates (newest first) - 2026-10-23: Ruby releases 4.0.9, 3.4.12 and 3.3.13 with the upstream fixes: a double free when parsing fails after an alternation (#13332), an integer overflow in the compiled pattern size (#19020) and an overflow of internal IDs in patterns with many repeats (#16801). Ruby requested no CVEs of its own and says to track GitLab's IDs in scanners. Credit: Johan Carlsson (joaxcar) via GitLab's bug bounty; GitLab reported and coordinated. (https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/) - 2026-10-23: Ruby 3.3 is in security maintenance and gets the Regexp fixes as an exception. 3.3.13 also updates the default resolv gem to 0.3.2, fixing CVE-2026-80212 and CVE-2026-80213. (https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/) - 2026-10-21: GitLab 19.5.1 and backports fix CVE-2026-110264 (CVSS 10.0, unauthenticated RCE from an integer overflow when compiling a crafted regex), affecting every CE/EE version from 7.0. (https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) - 2026-10-12: GitLab 19.4.2 fixes CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via a crafted CI/CD regex); Rapid7 shows the 19.4.1 repeat-bound check could be bypassed with an inline regex comment and built a working PoC against 19.4.1. (https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/) - 2026-09-23: GitLab 19.4.1 fixes CVE-2026-89078 (double free in its regex parser, CVSS 9.9, authenticated RCE via CI/CD config) and CVE-2026-93577 (integer overflow in the regex compiler) by patching the Ruby it ships. (https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/) ## Fix brief # Security brief: Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs Source: https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves · status: live · severity: critical · updated Oct 23, 2026, 13:43 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix. Severity detail: GitLab rates the CVEs critical: CVSS 3.1 10.0 for CVE-2026-97229 and CVE-2026-110264 (unauthenticated RCE), 9.9 for CVE-2026-89078 (authenticated). Ruby assigned no CVEs or score of its own; plain Ruby apps are only exposed if they compile regexes from untrusted strings. No exploitation reported. - Product: Ruby (CRuby / Onigmo regex engine) - CVE / advisory ids: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 ## Affected versions - Ruby 4.0 before 4.0.9 - Ruby 3.4 before 3.4.12 - Ruby 3.3 before 3.3.13 - Ruby 3.2 and older: end-of-life (3.2 since 2026-04-01), no fixed release - Only apps that compile a regular expression from an attacker-controlled string ## Check whether you're affected Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions: ```sh sudo gitlab-rake gitlab:env:info ``` ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 4.0.9 - 3.4.12 - 3.3.13 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Latest updates - Oct 23, 2026: Ruby releases 4.0.9, 3.4.12 and 3.3.13 with the upstream fixes: a double free when parsing fails after an alternation (#13332), an integer overflow in the compiled pattern size (#19020) and an overflow of internal IDs in patterns with many repeats (#16801). Ruby requested no CVEs of its own and says to track GitLab's IDs in scanners. Credit: Johan Carlsson (joaxcar) via GitLab's bug bounty; GitLab reported and coordinated. - Oct 23, 2026: Ruby 3.3 is in security maintenance and gets the Regexp fixes as an exception. 3.3.13 also updates the default resolv gem to 0.3.2, fixing CVE-2026-80212 and CVE-2026-80213. - Oct 21, 2026: GitLab 19.5.1 and backports fix CVE-2026-110264 (CVSS 10.0, unauthenticated RCE from an integer overflow when compiling a crafted regex), affecting every CE/EE version from 7.0. - Oct 12, 2026: GitLab 19.4.2 fixes CVE-2026-97229 (CVSS 10.0, unauthenticated RCE via a crafted CI/CD regex); Rapid7 shows the 19.4.1 repeat-bound check could be bypassed with an inline regex comment and built a working PoC against 19.4.1. - Sep 23, 2026: GitLab 19.4.1 fixes CVE-2026-89078 (double free in its regex parser, CVSS 9.9, authenticated RCE via CI/CD config) and CVE-2026-93577 (integer overflow in the regex compiler) by patching the Ruby it ships. ## Advisories - [Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/) (Ruby) - [Ruby 4.0.9 Released](https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/) (Ruby) - [Ruby 3.4.12 Released](https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/) (Ruby) - [Ruby 3.3.13 Released](https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/) (Ruby) - [Ruby Maintenance Branches](https://www.ruby-lang.org/en/downloads/branches/) (Ruby) - [GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) (GitLab) - [GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) (GitLab) - [GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/) (GitLab) ## Write-ups & news - [GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) technical analysis](https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/) ## Caveats CVE IDs are GitLab's (CNA GitLab); Ruby has not requested its own CVEs and may update its page. Fix-to-CVE mapping and first fixed release per branch from ruby-lang.org. Related: /i/gitlab-cve-2026-110264-regex-rce. --- Machine-readable: https://pwn.watch/i/ruby-regexp-compilation-fixes-gitlab-cves.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.