Ruby patches three regex bugs behind critical GitLab RCE flaws

Ruby published security releases 4.0.9, 3.4.12 and 3.3.13 on October 23 to close three bugs in Onigmo, its built-in regular expression engine. GitLab found that a crafted pattern could corrupt memory during compilation, potentially enabling code execution on its servers. According to Ruby, any program that compiles a regular expression from attacker-supplied text is vulnerable, not only GitLab.

An application is exposed only if it passes attacker-controlled text to Regexp.new, Regexp.union or Regexp.compile, or interpolates it into a pattern such as /#{input}/, Ruby's advisory says. Programs that use only developer-written regular expressions are not affected.

The patched versions are 4.0.9, 3.4.12 and 3.3.13. Release 4.0.8 lacks the patch for CVE-2026-110264, so users on 4.0 should move to 4.0.9. Ruby will not fix 3.2 or older; the 3.2 series hit end of life on April 1, 2026, and 3.2.11 was its last release.

Organizations that cannot upgrade immediately should stop compiling regular expressions from untrusted input, the advisory says. Setting Regexp.timeout will not stop the bugs, and length limits are unreliable because short patterns can trigger the flaws.

The Hacker News reported that GitLab compiles user-supplied regular expressions, including patterns in CI/CD configurations, and discovered that crafted patterns could corrupt memory during compilation. GitLab fixed the issues in four CVEs: two disclosed September 23 that require a logged-in account and carry a 9.9 CVSS score, and two disclosed October 12 and 21 that require no account and carry a 10.0 score. CVE-2026-110264 affects every GitLab version from 7.0 onward. A researcher using the handle joaxcar submitted all four to GitLab's bug bounty program, and as of October 23 none were listed in CISA's Known Exploited Vulnerabilities catalog.

Ruby has not requested its own CVE identifiers for these fixes "at least for now" and asks users to track the bugs with GitLab's four CVE numbers. The CVE records for GitLab list only GitLab as the affected product, so vulnerability scanners that compare those records with installed Ruby versions will find no match. Ruby has assigned CVE numbers for similar regex compilation flaws in 2022 and 2024. Its documentation still lists untrusted patterns only as a denial-of-service risk. The Ruby team said the advisory will be revised if the project later asks for CVE identifiers.

Self-managed GitLab administrators should install the release that fixes CVE-2026-110264: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, shipped October 21. GitLab.com is already on the patched version, and tenants on GitLab Dedicated with recent internal releases require no action, according to GitLab. GitLab also published detection rules for self-managed administrators to look for exploitation attempts.

Update, October 24, 2026

LavX News identified the October 12 GitLab vulnerability as CVE-2026-97229. The outlet also reported that Ruby recommends users on 3.2 or earlier upgrade to 3.4 or 4.0, because patches will not be backported. LavX News noted that Ruby 4.0.8 was released the same week. It added that GitLab bundles its own copy of Ruby, so installing a patched GitLab release applies the regex engine patch.