{"id":3748,"date":"2026-10-23T18:49:22","date_gmt":"2026-10-23T18:49:22","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3748"},"modified":"2026-10-23T18:49:22","modified_gmt":"2026-10-23T18:49:22","slug":"ruby-fixes-three-regex-engine-bugs-responsible-for-four-critical-gitlab-rce-flaws","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3748","title":{"rendered":"Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Oct 23, 2026<\/span><\/span>Vulnerability \/ Software Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.<\/p>\n

GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.<\/p>\n

Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab.<\/p>\n

Which Applications Are Affected<\/h3>\n

In its advisory<\/a>, Ruby said an application is affected only if it compiles a regular expression from a string an attacker controls. That happens when a program passes such a string to Regexp.new, Regexp.union or Regexp.compile, or places it inside a pattern through interpolation, as in \/#{input}\/.<\/p>\n

Applications that only use regular expressions written by their own developers are not affected.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Ruby fixed the bugs in 4.0.9, 3.4.12, and 3.3.13. The 3.4.12 and 3.3.13 releases are the first in their series to carry any of the three fixes.<\/p>\n

An earlier release from the same week, 4.0.8, does not include the fix for one of the flaws, CVE-2026-110264<\/a>, so 4.0 users should install 4.0.9.<\/p>\n

<\/p>\n

Ruby 3.2 and earlier will not get a fix. Ruby 3.2 reached end of life<\/a> on April 1, 2026, and 3.2.11 was its final release. Ruby recommends moving to 3.4 or 4.0.<\/p>\n

If you cannot upgrade yet, the advisory says to stop compiling regular expressions from untrusted input.<\/p>\n

Two defenses that look like they would help do not. Setting Regexp.timeout does not stop these bugs. Capping the length of a pattern is also unreliable because short patterns can trigger bugs.<\/p>\n

How the Bugs Reached GitLab<\/h3>\n

GitLab compiles regular expressions supplied by its users, such as the patterns in a CI\/CD configuration. It found that crafted patterns could corrupt memory as Ruby compiled them, and it issued four CVEs between September 23<\/a> and October 21, fixing each by shipping a patched Ruby.<\/p>\n

The first two, disclosed on September 23, each need a logged-in account and were rated 9.9 out of 10. The two from October, CVE-2026-97229<\/a> on the 12th and CVE-2026-110264 on the 21st, need no account and were rated 10.0, the maximum. CVE-2026-110264 reaches every GitLab version from 7.0 onward.<\/p>\n

A researcher using the handle joaxcar reported all four through GitLab’s bug bounty program. As of October 23, none of the four was listed in CISA’s Known Exploited Vulnerabilities catalog.<\/p>\n

No Ruby CVE, for Now<\/h3>\n

Ruby has not requested CVE identifiers of its own for these fixes, \u00abat least for now,\u00bb it said, and told users to track the issues by GitLab’s four CVE numbers instead.<\/p>\n

That leaves a gap for anyone who scans by CVE. GitLab’s CVE records name only GitLab as the affected product, so a scanner that checks those records against installed Ruby versions has nothing to match.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Ruby has treated this kind of bug as a vulnerability before, assigning CVE numbers to fixes in 2022<\/a> and 2024<\/a>, even though it has long been unsafe to build a regular expression from untrusted input.<\/p>\n

Its documentation<\/a> still describes untrusted patterns only as a denial-of-service risk. Ruby said it will update its advisory if it requests any CVE identifiers.<\/p>\n

For GitLab Administrators<\/h3>\n

Self-managed GitLab instances need the release that fixes CVE-2026-110264. GitLab shipped it<\/a> on October 21 and backported it as far as version 18.11.13.<\/p>\n