- Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to patch four critical vulnerabilities in the Onigmo regular expression engine, two rated the maximum 10.0 severity.
- The flaws allow remote code execution when applications compile regular expressions from untrusted input, affecting cryptocurrency platforms using GitLab for CI/CD and code hosting.
- GitLab backported fixes to versions as far back as 18.11.13, but Ruby 3.2 and earlier will not receive patches after reaching end of life on April 1, 2026.
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to patch four critical security vulnerabilities in Onigmo, the regular expression engine embedded in the language, after GitLab discovered that specially crafted patterns could corrupt memory during compilation and enable remote code execution. According to Ruby’s advisory, any application that compiles a regular expression from attacker-controlled input—including cryptocurrency platforms and fintech services relying on GitLab—is affected.
GitLab disclosed the four CVEs between September 23 and October 21, with CVE-2026-110264 affecting every GitLab version from 7.0 onward and requiring no authentication to exploit. The other three include two rated 9.9 that need a logged-in account and CVE-2026-97229, disclosed October 12, which also carries a maximum 10.0 severity and requires no account.
Researcher joaxcar reported all four flaws through GitLab’s bug bounty program, and as of October 23, none appeared in CISA’s Known Exploited Vulnerabilities catalog. Ruby has not requested its own CVE identifiers for these fixes, directing users to track the issues by GitLab’s CVE numbers instead.
Ruby 3.2 and earlier will not receive patches, as that branch reached end of life on April 1, 2026, and Ruby recommends moving to version 3.4 or 4.0. For administrators who cannot upgrade, the advisory warns that setting Regexp.timeout or capping pattern length does not prevent exploitation, and the only defense is to stop compiling regular expressions from untrusted input.
GitLab shipped the fix for CVE-2026-110264 on October 21 and backported it to versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, while GitLab.com already runs the patched version. Self-managed administrators can use published detection rules to look for signs of exploitation attempts.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
