Do Son 
TL;DR
On October 23, 2026, the Ruby team shipped a Ruby security update in versions 4.0.9, 3.4.12 and 3.3.13. The releases fix memory bugs in Onigmo, Ruby’s regular expression engine. GitLab had found that these bugs allowed remote code execution on its servers and assigned four CVEs to them.
- Product: GitLab
- Vulnerabilities: 4 flaws (CVE-2026-110264, CVE-2026-97229, CVE-2026-89078, CVE-2026-93577)
- Highest severity: 10.0 (Critical · CVSSv3)
- Worst impact: Integer Overflow or Wraparound in
- Status: No confirmed exploitation yet; patches available
- Action: Update to 18.11.13, 19.0.10, 19.1.9, 19.2.9 (+9) now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-110264 | 10 | CWE-190 | 18.11.13, 19.0.10, 19.1.9 (+4) | Not exploited |
| CVE-2026-97229 | 10 | CWE-190 | 19.2.8, 19.3.5, 19.4.2 | Not exploited |
| CVE-2026-89078 | 9.9 | CWE-415 | 19.2.7, 19.3.3, 19.4.1 | Not exploited |
| CVE-2026-93577 | 9.9 | CWE-190 | 19.2.7, 19.3.3, 19.4.1 | Not exploited |
Why It Matters
GitLab already patched the Ruby it ships. However, any other Ruby app that compiles user-supplied patterns faces the same risk. GitLab rates two of the CVEs at CVSS 10.0, since they need no login. The other two score 9.9 and require an authenticated user.
How the Attack Works
GitLab “compiles regular expressions supplied by its users, such as patterns in CI configuration, with Regexp.new.” According to the Ruby advisory on regexp fixes for GitLab CVEs, “specially crafted patterns could corrupt memory while Ruby compiles them.”
The bugs map to three root causes:
- CVE-2026-89078: a double free when parsing fails after an alternation.
- CVE-2026-93577 and CVE-2026-97229: an integer overflow in the size of a compiled pattern.
- CVE-2026-110264: an overflow of internal IDs in a pattern with many repeats.
Exploitation status
No source reports exploitation in the wild.
Affected Versions
Apps are at risk only when they compile a regex “from a string that an attacker controls.” That includes Regexp.new, Regexp.union, Regexp.compile and interpolated literals. Apps using only developer-written patterns are not affected.
On the GitLab side, CVE-2026-110264 affects versions back to 7.0, fixed in 18.11.13, 19.5.1 and other patch releases.
Patch and Mitigation Steps
- Install the Ruby security update: 4.0.9, 3.4.12 or 3.3.13.
- Upgrade GitLab to the latest patch release.
- If you cannot upgrade, avoid compiling regexes from untrusted input.
Notably, Ruby warns that “Regexp.timeout does not protect against these bugs.” Length limits fail too, because short patterns can trigger some flaws. Ruby 3.3.13 includes the fixes as an exception to its security-only phase. Finally, Ruby has not requested its own CVE IDs for the Onigmo fixes, “at least for now.” So scanners keyed only to Ruby CVEs may miss this Ruby security update.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
