Ruby 4.0.9, 3.4.12 and 3.3.13 fix the regexp bugs behind GitLab RCEs

Ruby 4.0.9, 3.4.12 and 3.3.13 fix the regexp bugs behind GitLab RCEs

23 October 2026: The Ruby core team has released Ruby 4.0.9, 3.4.12 and 3.3.13 with fixes for memory corruption bugs in Onigmo, Ruby's regular expression engine, that GitLab turned into remote code execution on its servers. Any Ruby application that compiles a regular expression from a string an attacker controls is exposed in the same way, and upgrading is the fix.

Not yet independently verified. Ruby has not assigned CVE identifiers of its own and says it is still deciding whether to treat these as Ruby vulnerabilities; the identifiers here are GitLab's. We will update this when it can be confirmed, and remove this note.

From GitLab patches to upstream releases

GitLab compiles patterns its users supply, such as those in CI configuration, with Regexp.new. It found that crafted patterns could corrupt memory during compilation and fixed the problem by patching the Ruby it ships, assigning four CVEs, two of which we covered from the GitLab side: CVE-2026-97229 and CVE-2026-110264. The Ruby releases now carry the underlying fixes for everyone else.

GitLab CVE	Bug in Ruby	First fixed in 4.0	3.4	3.3
CVE-2026-89078	double free when parsing fails after an alternation	4.0.0	3.4.12	3.3.13
CVE-2026-93577, CVE-2026-97229	integer overflow in the size of a compiled pattern	4.0.8	3.4.12	3.3.13
CVE-2026-110264	overflow of internal IDs in a pattern with many repeats	4.0.9	3.4.12	3.3.13

Ruby 3.3 is in security maintenance and would not normally take these fixes; 3.3.13 includes them as an exception because GitLab assigned CVEs to issues that depend on them. The same release updates the default resolv gem to 0.3.2 for CVE-2026-80212 and CVE-2026-80213.

Which code is at risk

Only code that compiles a pattern from untrusted input reaches the bugs: Regexp.new, Regexp.union or Regexp.compile on a user-supplied string, or interpolation into a literal such as /#{input}/. Applications that only use patterns their own developers wrote are not affected.

The Ruby team rules out the two usual mitigations. Regexp.timeout guards against slow matching, not against memory corruption at compile time, so it does not help. Limiting the length of patterns does not reliably help either, because some of the bugs fire on short patterns. Search features that accept regular expressions, rule engines, log filters and CI or workflow tools that let users write patterns are the obvious places to look.

Tracking it in scanners

Ruby has not requested CVE identifiers of its own. It has long treated compiling untrusted patterns as unsafe, yet its documentation discusses that case only as a denial-of-service risk, and the team says it will decide how to document it and whether to request identifiers; until then it asks users to track the issues under GitLab's four CVEs. The integer overflow fixed in change #19020 was found by Johan Carlsson through GitLab's bug bounty programme.

Sources

• Ruby: Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264, 23 October 2026
• Ruby: Ruby 4.0.9 Released, 23 October 2026
• Ruby: Ruby 3.3.13 Released, 23 October 2026