Ruby shipped 4.0.9, 3.4.12 and 3.3.13 on October 23, closing three memory-safety bugs in Onigmo, the language’s built-in regular expression engine.
Those bugs sit underneath four critical GitLab flaws patched over the past month. GitLab compiles user-supplied patterns, including CI/CD configuration, through Regexp.new. Patterns crafted to corrupt memory during compilation were turned into remote code execution on its servers, and each GitLab release carried a patched Ruby.
The four CVEs and what they cost
The pair disclosed September 23, CVE-2026-89078 and CVE-2026-93577, each needed a logged-in account and scored 9.9. The October pair needed none and scored 10.0: CVE-2026-97229 on October 12 and CVE-2026-110264 on October 21, the latter reaching every GitLab version from 7.0 onward. A researcher using the handle joaxcar reported all four.
Ruby 4.0.8, released the same week, misses the CVE-2026-110264 fix, so 4.0 users need 4.0.9. Ruby 3.2 reached end of life on April 1, 2026 and gets nothing.
Two defenses that do not work
Setting Regexp.timeout will not stop these. Capping pattern length is unreliable too, because short patterns trigger the bugs.
The exposure test is simple. If your code passes user input to Regexp.new, Regexp.union or Regexp.compile, or interpolates it into a literal like /#{input}/, you are in scope. Patterns written by your own developers are not.
A scanner blind spot
Ruby requested no CVE of its own, telling users to track GitLab’s numbers. Those records name GitLab as the product, so a scanner comparing them to installed Ruby versions has nothing to match. Verify the interpreter version directly.
