Ruby released 4.0.9, 3.4.12 and 3.3.13 on October 23 to fix three bugs in its Onigmo regular-expression engine. Ruby says GitLab found that specially crafted patterns could corrupt memory during compilation and could be used for remote code execution on GitLab servers.
The affected path is narrower than ordinary regex use: an application must compile a regular expression from text controlled by an attacker. Ruby identifies Regexp.new, Regexp.union, Regexp.compile and interpolation into a regex literal such as /#{input}/ as examples. Applications that use only patterns written by their developers are not affected, according to the Ruby advisory.
The underlying issues correspond to four GitLab CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Ruby’s release notes describe the bugs as a double free after a failed alternation parse, an integer overflow in compiled-pattern size, and an overflow involving internal IDs in patterns with many repeats. All three fixes are included in the listed Ruby releases.
The Hacker News reports that GitLab disclosed the four flaws between September 23 and October 21, and that the two October issues were rated 10.0. It also reports that CVE-2026-110264 affects every GitLab version from 7.0 onward and that none of the four CVEs was listed in CISA’s Known Exploited Vulnerabilities catalog as of October 23. Those details come from The Hacker News’ report, rather than an independent confirmation in this report.
Ruby recommends upgrading to 4.0.9, 3.4.12 or 3.3.13. If upgrading is not possible, users should avoid compiling regular expressions from untrusted input. Ruby says Regexp.timeout and limiting pattern length do not reliably prevent these bugs. Ruby 3.2 and earlier are not covered by these releases. The Hacker News reports that Ruby 3.2 reached end of life on April 1, 2026, with 3.2.11 as its final release, and that Ruby recommends moving to 3.4 or 4.0 according to its report.