Overview
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical flaws that GitLab patched between September 23 and October 21, 2026. GitLab found that a specially crafted pattern can corrupt memory while it is being compiled, which can lead to code execution.
The Four GitLab CVEs
| CVE | Disclosed | CVSS | Account required |
|---|---|---|---|
| Two earlier flaws | September 23 | 9.9 | Yes |
| CVE-2026-97229 | October 12 | 10.0 | No |
| CVE-2026-110264 | October 21 | 10.0 | No |
A researcher known as joaxcar reported all four through GitLab's bug bounty program. As of October 23, none appeared in CISA's Known Exploited Vulnerabilities catalog.
Who Is Affected
An application is at risk if it compiles a regex from attacker-controlled text, for example through Regexp.new, Regexp.union, Regexp.compile, or interpolation such as /#{input}/. Applications that use only developer-written regexes are not affected.
| Ruby branch | Fixed version | Note |
|---|---|---|
| 4.0 | 4.0.9 | 4.0.8 lacks the fix for CVE-2026-110264 |
| 3.4 | 3.4.12 | |
| 3.3 | 3.3.13 | |
| 3.2 and earlier | No fix | Ruby 3.2 reached end of life on April 1, 2026 |
GitLab bundles its own Ruby, so installing a fixed GitLab release applies the Ruby fix. CVE-2026-110264 is fixed in GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com is already patched.
Mitigation Notes
- Upgrade Ruby, or GitLab for self-managed instances, to a fixed version.
- If you cannot upgrade, stop compiling regexes from untrusted input.
- Setting
Regexp.timeoutdoes not stop these bugs, and limiting pattern length is unreliable because short patterns can also trigger them. - GitLab published detection rules that self-managed administrators can use to look for exploitation attempts.
Tracking Gap
Ruby has not requested its own CVE IDs for these fixes and advises tracking the GitLab CVEs instead. GitLab's CVE records list only GitLab as affected, so scanners that check installed Ruby versions may miss the issue. Audit custom Ruby applications that build regexes from user input directly.