CVE Analysis Center Oct 25, 2026 10 min read ← All posts

Ruby Fixes the Onigmo Regexp Bugs Behind GitLab's Four CVEs: Upgrade to 4.0.9, 3.4.12 or 3.3.13 If Your Apps Compile Untrusted Patterns

Ruby Onigmo regex engine: fixes out in Ruby 4.0.9, 3.4.12 and 3.3.13 for apps that compile untrusted regular expressions; not in CISA KEV.

On 23 October 2026 the Ruby core team released Ruby 4.0.9, 3.4.12 and 3.3.13. The releases fix three bugs in Onigmo, the regular-expression engine built into Ruby. GitLab had found that these bugs could be turned into remote code execution on GitLab servers, and it fixed them in its own releases between 23 September and 21 October under four GitLab CVE IDs. Ruby's point is that the bugs live in Ruby itself, so they matter for any Ruby application that builds a regular expression from text an attacker controls, not only GitLab.

Most Ruby applications are not in that position. Ruby says the bugs are reached only when an app compiles a regular expression from an attacker-controlled string. Apps that only use regular expressions written by their own developers are not affected. As of 25 October 2026, 08:16 Cyprus time (UTC+2), no exploitation has been reported, in GitLab or elsewhere: GitLab's release posts do not report any, and the CISA assessment attached to all four CVE records says "Exploitation: none". None of the four CVEs is in CISA's Known Exploited Vulnerabilities (KEV) catalog, and Ruby has not requested CVE IDs of its own.

We covered the GitLab side, including GitLab's fixed versions and detection rules, in our GitLab CVE-2026-110264 post. This post is about everyone else who runs Ruby.

Technical Information

What Ruby has said (Ruby announcement, 23 October 2026):

  • GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with Regexp.new. GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab servers.
  • The fixes are three changes in Ruby: a double free when parsing a pattern fails after an alternation (Ruby change #13332), an integer overflow in the size of a compiled pattern (#19020), and an overflow of internal IDs in a pattern with many repeats (#16801).
  • "These bugs are reached only when an application compiles a regular expression from a string that an attacker controls, for example by passing it to Regexp.new, Regexp.union or Regexp.compile, or by interpolating it into a regexp literal such as /#{input}/."
  • "Applications that only use regular expressions written by their own developers are not affected."
  • Regexp.timeout does not protect against these bugs. Limiting the length of patterns does not reliably protect either, because Ruby says some of the bugs can be triggered by short patterns.
  • Ruby has "not requested CVE identifiers in Ruby for these fixes, at least for now", and asks users to track the issues by GitLab's CVE IDs, for example in a security scanner. Ruby says it will discuss whether to treat this kind of issue as a Ruby vulnerability and will update its page if it requests any CVE IDs.

How the GitLab CVEs map to the Ruby fixes (Ruby's table; scores are GitLab's, as the CVE Numbering Authority, and describe GitLab, not Ruby):

GitLab CVEBug in Ruby (Ruby change)GitLab release and dateGitLab's CVSS 3.1
CVE-2026-89078Double free when parsing a pattern fails after an alternation (#13332)19.4.1, 23 September 20269.9 (authenticated user)
CVE-2026-93577Integer overflow in the size of a compiled pattern (#19020)19.4.1, 23 September 20269.9 (authenticated user)
CVE-2026-97229Same Ruby bug as above (#19020)19.4.2, 12 October 202610.0 (unauthenticated)
CVE-2026-110264Overflow of internal IDs in a pattern with many repeats (#16801)19.5.1, 21 October 202610.0 (unauthenticated)

How serious is this for Ruby apps that are not GitLab? Ruby has not scored these fixes, and there is no CVSS score for Ruby itself. GitLab rates its four CVEs Critical for GitLab, where user-supplied patterns reach the regex compiler directly. For other software, the risk depends entirely on whether attacker-controlled text ever becomes a regular expression. For most supplier portfolios we treat this as a medium-priority, check-and-patch item: important where a product lets users or customers supply patterns, irrelevant where it does not (Rescana assessment, not a CVSS score).

The compile call can sit inside a dependency. GitLab's published detection notes say one of its affected paths ran through a third-party gem that builds a regular expression from file content (GitLab Security, "Onigmo native worker crash" detection). So a team that never writes Regexp.new itself can still be in scope through a library it uses.

Why scanners may miss it. The four CVE records on cve.org list only GitLab as the affected product, and NVD's product matches (CPEs) for the three records it has analysed name only GitLab. NVD has not added scores of its own; it shows GitLab's. A scanner that matches CVE records against installed packages will therefore not flag an unpatched Ruby runtime under these IDs. Ruby's security page, which lists its CVE advisories, does not include the 23 October announcement either.

What is not known yet:

  • Whether Ruby will request its own CVE IDs, and whether it will treat compiling untrusted patterns as a supported use case. Ruby's Regexp documentation currently discusses untrusted patterns only as a denial-of-service concern and recommends a timeout.
  • When operating-system distributions, container images and other software that bundles its own Ruby will ship these fixes. We have not checked them, and without a Ruby CVE ID some may not track the issue.
  • Which other products compile user-supplied patterns. No vendor other than GitLab has published an advisory linked to these fixes.

Timeline (dates as published; times in Cyprus time where the source gives one: UTC+3 until 25 October, UTC+2 from 25 October):

  • 27 March 2026: Ruby 3.2.11, the final release of the 3.2 series. Ruby 3.2 reached end of life on 1 April 2026.
  • 23 September 2026: GitLab 19.4.1, 19.3.3 and 19.2.7 fix CVE-2026-89078 and CVE-2026-93577.
  • 12 October 2026: GitLab 19.4.2, 19.3.5 and 19.2.8 fix CVE-2026-97229. CERT-EU publishes advisory 2026-016 for GitLab.
  • 21 October 2026: GitLab 19.5.1 and backports (down to 18.11.13) fix CVE-2026-110264. CERT-EU publishes advisory 2026-019 for GitLab on 22 October.
  • 22 October 2026: Ruby 4.0.8, a routine bugfix release. Per Ruby's table it contains two of the three fixes but not #16801.
  • 23 October 2026, 06:11 (03:11 UTC): Ruby publishes its announcement and releases 4.0.9, 3.4.12 and 3.3.13.
  • 25 October 2026, 08:16 (UTC+2): None of the four CVEs is in CISA KEV (catalog version 2026.10.23). All four cve.org records carry a CISA-ADP assessment of "Exploitation: none". We found no Ruby advisory from CISA, CERT-EU, CCCS, BSI or JPCERT.

Affected Product Versions

Applies only to applications that compile regular expressions from attacker-controlled text (see above). Versions and status from Ruby's announcement and maintenance branches page.

Ruby branchBranch statusFixed release (contains all three fixes)Notes
4.0Normal maintenance4.0.9 (23 Oct 2026)4.0.8 (22 Oct) is not enough: it lacks the fix behind GitLab's CVE-2026-110264. 4.0.0 to 4.0.7 lack two of the three fixes.
3.4Normal maintenance3.4.12 (23 Oct 2026)First 3.4 release with any of the three fixes.
3.3Security maintenance (end of life expected 31 March 2027)3.3.13 (23 Oct 2026)Ruby included the fixes as an exception, because GitLab assigned CVEs. First 3.3 release with any of the fixes.
3.2 and olderEnd of life (3.2 since 1 April 2026)NoneRuby said 3.2.11 was the final 3.2 release, with no further updates "including security fixes", and recommends moving to 3.4 or 4.0 (Ruby 3.2.11 post).
GitLab self-managed—GitLab's fixed versionsGitLab ships its own patched Ruby. GitLab.com and GitLab Dedicated are patched, GitLab says. See our GitLab post.

Ruby's announcement does not mention the 4.1 preview release.

Workaround and Mitigation

1. Find out whether you compile untrusted patterns. Look for features where users, customers or partners supply something that becomes a regular expression: search or filter boxes that accept regex, alerting or rule builders, routing, allow-list or deny-list settings, CI or workflow configuration, and content rendering. Check dependencies as well as your own code, because the compile call can sit inside a gem (Rescana guidance).

2. Upgrade Ruby. Ruby recommends 4.0.9, 3.4.12 or 3.3.13 or later. On 4.0, make sure you are on 4.0.9, not 4.0.8. On 3.2 or older there is no fix; move to 3.4 or 4.0. Remember Ruby copies you do not manage directly: container base images, language version managers, and products that bundle their own Ruby (Rescana guidance).

3. If you cannot upgrade yet, Ruby's advice is to avoid compiling regular expressions from untrusted input. Where a feature depends on it, consider switching that feature off until the runtime is patched (Rescana guidance).

4. Do not rely on the usual regex defences. Ruby says Regexp.timeout does not protect against these bugs and that limiting pattern length is not reliable.

5. Track by GitLab's CVE IDs, but do not trust a clean scan. Ruby asks users to track the issues under the four GitLab CVE IDs. Because those records name only GitLab, check Ruby versions directly rather than waiting for a scanner finding (Rescana guidance).

Indicators of Compromise

Ruby has published no indicators of compromise, and we know of none for Ruby applications other than GitLab. GitLab has published behaviour-based detection rules for self-managed GitLab, linked in our GitLab post. Those rules look for Ruby interpreter crash reports that involve the Onigmo engine. In other Ruby applications, an unexplained interpreter crash in regex code is worth a look (Rescana guidance). But GitLab warns that a successful exploit "does not reliably crash", so a quiet log does not prove a system is clean. There are no hashes, IP addresses or domains to share.

What we will update

We will update this post if Ruby requests CVE IDs or changes its announcement or documentation, if exploitation is reported against any Ruby application other than GitLab, if CISA adds any of the four CVEs to KEV, if the CVE or NVD records add Ruby as an affected product, or if a national CERT issues a Ruby advisory.

Sources

Follow-up-of: gitlab-cve-2026-110264-unauthenticated-rce-october-2026

Ruby runs inside many SaaS platforms, developer tools and internal portals your suppliers operate, and a fix with no Ruby CVE ID is easy for their scanners to miss. Working with your key vendors to confirm they either never compile customer-supplied patterns or are on the fixed Ruby releases closes that gap quickly and without drama.

Forward this to your TPRM owner: Ask your key software and SaaS suppliers whether any product they run for you lets users supply regular expressions, and if so, whether those systems are on Ruby 4.0.9, 3.4.12 or 3.3.13 or later (not 4.0.8, and not 3.2 or older) (Rescana guidance).

Want a fast, evidence-based view of which suppliers in your vendor ecosystem run the software behind advisories like this one, and how quickly they patch? Book a demo.

Contact us / Book a demo

Talk to Rescana about this advisory, or book a demo of the platform.

Recent Posts

See All →
Quest Diagnostics Quanum LSM Incident: System Restored, Patient Data Scope Still Under Investigation
Oct 25, 2026
Quest Diagnostics Quanum LSM Incident: System Restored, Patient Data Scope Still Under Investigation
Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447): Exploited Flaw Added to CISA KEV, Upgrade or Remove the App
Oct 24, 2026
Collabora Online Built-in CODE Server for Nextcloud (CVE-2026-110447): Exploited Flaw Added to CISA KEV, Upgrade or Remove the App
HPE Aruba Networking AOS-8 and AOS-10 Bulletin HPESBNW05162: CVE-2026-79844 and Seven More Flaws Rated 10.0, Patch Now
Oct 23, 2026
HPE Aruba Networking AOS-8 and AOS-10 Bulletin HPESBNW05162: CVE-2026-79844 and Seven More Flaws Rated 10.0, Patch Now