Ruby Patches Critical Regex Flaws After GitLab CVEs

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to patch four critical security vulnerabilities in Onigmo, the regular expression engine embedded in the language, after GitLab discovered that specially crafted patterns could corrupt memory during compilation and enable remote code execution. According to Ruby’s advisory, any application that compiles a regular expression from attacker-controlled input—including cryptocurrency platforms and fintech services relying on GitLab—is affected.

GitLab disclosed the four CVEs between September 23 and October 21, with CVE-2026-110264 affecting every GitLab version from 7.0 onward and requiring no authentication to exploit. The other three include two rated 9.9 that need a logged-in account and CVE-2026-97229, disclosed October 12, which also carries a maximum 10.0 severity and requires no account.

Researcher joaxcar reported all four flaws through GitLab’s bug bounty program, and as of October 23, none appeared in CISA’s Known Exploited Vulnerabilities catalog. Ruby has not requested its own CVE identifiers for these fixes, directing users to track the issues by GitLab’s CVE numbers instead.

Ruby 3.2 and earlier will not receive patches, as that branch reached end of life on April 1, 2026, and Ruby recommends moving to version 3.4 or 4.0. For administrators who cannot upgrade, the advisory warns that setting Regexp.timeout or capping pattern length does not prevent exploitation, and the only defense is to stop compiling regular expressions from untrusted input.

GitLab shipped the fix for CVE-2026-110264 on October 21 and backported it to versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, while GitLab.com already runs the patched version. Self-managed administrators can use published detection rules to look for signs of exploitation attempts.

✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.

Previous Articles:

• Senator demands Tether records on Hines deal
• k0t Campaign Exploits Fortinet and Palo Alto Firewalls
• BRICS Drops De-Dollarization, Vows Not Anti-Western
• a16z Drops ‘Crypto’ From Its Fund Name
• Banks lose $22.8B as AI bots access customer accounts