Security incidents tagged Alpine Linux. Newest first.
Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.
Ruby (CRuby / Onigmo regex engine)Since Oct 23, 2026
We released Ruby 4.0.9, 3.4.12, and 3.3.13, and published an announcement about Regexp compilation fixes. t.co/zTemAPrS2A If your application compiles a regular expression from an untrusted string, please update your Ruby to one of those versions.
