BrevFeed
Sign in
← All stories
● Covered by 1 source · 1 reportMedium impact1 neutral

Ruby Fixes Three Regex Engine Bugs Addressing Four Critical GitLab RCE Flaws

🔄 Updated 14d ago
Aggregated by BrevFeed security · updated 14d ago
🔖 Save
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • Ruby versions 4.0.9, 3.4.12, 3.3.13 fix three Onigmo regex bugs.
  • Bugs caused four critical RCE flaws in GitLab.
  • Affected applications compile regex from untrusted input.
  • Ruby 3.2 and earlier will not receive fixes.

Ruby Patches Regular Expression Engine

Ruby has released new versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs within its built-in regular expression engine, Onigmo. These updates are critical as the identified bugs are linked to four severe security vulnerabilities that GitLab recently patched.

Impact on Applications

The vulnerabilities affect applications that compile regular expressions from text controlled by an attacker. This occurs when a program uses functions like Regexp.new, Regexp.union, Regexp.compile, or interpolates untrusted input into a pattern. Applications that only use developer-written regular expressions are not at risk. Ruby 3.2 and older versions will not receive these fixes, with Ruby recommending an upgrade to 3.4 or 4.0.

GitLab's Vulnerabilities

GitLab discovered that specially crafted regular expression patterns, supplied by users for features like CI/CD configurations, could corrupt memory during compilation, potentially leading to remote code execution. GitLab issued four CVEs between September 23 and October 21 to address these issues. The two October CVEs, CVE-2026-97229 and CVE-2026-110264, were rated 10.0 (critical) and did not require authentication. CVE-2026-110264 affects all GitLab versions from 7.0 onwards.

Mitigation and Recommendations

For users unable to upgrade Ruby immediately, the advisory suggests ceasing the compilation of regular expressions from untrusted input. Setting Regexp.timeout or capping pattern length are not effective defenses against these specific bugs. The vulnerabilities were reported by researcher joaxcar through GitLab's bug bounty program.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

Keep reading

security Alpine Linux GitLab Server Targeted by Exploit for Critical Ruby Vulnerability 4d ago security Adobe Patches Critical ColdFusion and Campaign Classic Vulnerabilities Amid Exploits 11h ago security Chrome 150 Update Addresses 27 Vulnerabilities, Enhances Security 2d ago security Node.js Updates Fix Brotli Decoder RCE Vulnerability Across Supported Versions 9d ago security PHP warns of two critical RCE flaws, emergency patches due October 21 2d ago

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~4 min · 3 stories · Nov 07

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

Primary sources

CVE CVE-2026-11026410.0 CRITICAL CVE CVE-2026-9722910.0 CRITICAL CVE CVE-2022-287389.8 CRITICAL CVE CVE-2024-272826.6 MEDIUM

Reporting from

The Hacker News — Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws 15d ago →

Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to patch three bugs in its Onigmo regular expression engine. These bugs were responsible for four critical remote code execution vulnerabilities in GitLab, which were patched over the past month. Any application that compiles regular expressions from attacker-controlled text is affected, not just GitLab.