Ruby fixes three regex bugs behind four critical GitLab RCE flaws
Original title: Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Apps that compile attacker-controlled patterns are affected; GitLab’s unauthenticated CVE-2026-110264 covers versions from 7.0 and is not in KEV.
Ruby released 4.0.9, 3.4.12, and 3.3.13 to fix three Onigmo regular-expression bugs that GitLab linked to four critical remote code execution flaws. Crafted patterns can corrupt memory during compilation when an application builds a regex from attacker-controlled text. Two October GitLab issues need no account and were rated 10.0; none of the four was in CISA’s KEV catalog as of October 23. Ruby has not requested its own CVE identifiers and says scanners should track GitLab’s CVE numbers. Ruby 3.2 and earlier will not be fixed.
Unconfirmed: No exploitation is confirmed; the flaws were simply absent from CISA’s KEV catalog as of October 23.
- Ruby 4.0.8 does not fix CVE-2026-110264; 4.0 users need 4.0.9.
- Regexp.timeout and pattern-length limits do not stop the bugs.
- GitLab backported the October 21 fix as far as 18.11.13.
- GitLab.com is already patched; recent Dedicated tenants need no action.
- Researcher joaxcar reported all four flaws through GitLab’s bounty program.
Impact: Memory corruption during regex compilation, potentially code execution
| Product | Affected | Fixed in |
|---|---|---|
| Ruby | 4.0 before 4.0.9, 3.4 before 3.4.12, 3.3 before 3.3.13, and 3.2 and earlier | 4.0.9, 3.4.12, and 3.3.13 |
| GitLab | CVE-2026-110264 affects versions from 7.0 onward | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 |
- 1.Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13, or move off end-of-life 3.2.
- 2.Install the GitLab release that fixes CVE-2026-110264 on self-managed instances.
- 3.Stop compiling regular expressions from untrusted input if you cannot upgrade.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | <1% | PoC ×8 | |
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | <1% | PoC ×4 |
From the original article
3 min read at thehackernews.com
Ruby has released versions 4. 0. 9, 3.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.