Ruby Releases Security Updates for Critical Regular Expression Vulnerabilities

Ruby has released new versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs in Onigmo, the regular expression engine used by the programming language. These underlying issues are associated with four critical security vulnerabilities that GitLab patched between September and October 2026.

The vulnerabilities could allow specially crafted regular expression patterns to corrupt memory during compilation, potentially leading to arbitrary code execution in affected applications.

The risk extends beyond GitLab. According to Ruby’s security advisory, any application that compiles regular expressions from attacker-controlled input may be vulnerable.

Developers and system administrators are advised to upgrade to the latest patched Ruby release available for their version and avoid compiling regular expressions from untrusted input until the necessary updates are applied.

Which Applications Are Vulnerable?

Ruby applications are affected when they construct or compile regular expressions using strings that an attacker can control.

This can occur when applications pass untrusted input to methods such as:

• Regexp.new
• Regexp.union
• Regexp.compile

The same risk applies when user-controlled input is interpolated directly into a regular expression, such as /#{input}/.

Applications that use only regular expression patterns defined and controlled by their developers are not affected by this particular attack scenario.

The vulnerabilities originate in Onigmo, Ruby’s regular expression engine, where specially crafted patterns can trigger memory corruption during compilation.

Ruby Security Updates and Fixed Versions

Ruby has addressed the issues in the following releases:

• Ruby 4.0: Upgrade to 4.0.9.
• Ruby 3.4: Upgrade to 3.4.12.
• Ruby 3.3: Upgrade to 3.3.13.

The Ruby 3.4.12 and 3.3.13 releases include the relevant fixes for the first time in their respective release series.

Administrators should note that Ruby 4.0.8 does not address CVE-2026-110264. Users running Ruby 4.0 should therefore upgrade to version 4.0.9 rather than relying on the earlier release.

Ruby 3.2 and older versions will not receive these fixes through new upstream releases. Ruby 3.2 reached end of life on April 1, 2026, with version 3.2.11 being its final release.

Organizations using unsupported versions should migrate to a maintained release, preferably Ruby 3.4 or 4.0, or apply a verified security backport provided by their distribution vendor where available.

If an immediate upgrade is not possible, Ruby recommends avoiding the compilation of regular expressions built from untrusted input.

Two commonly considered workarounds are insufficient:

• Setting Regexp.timeout does not prevent the underlying vulnerabilities.
• Limiting regular expression length is not a reliable defense because even short patterns may trigger the bugs.

How the Vulnerabilities Affected GitLab

The security issues came to wider attention after GitLab identified memory corruption vulnerabilities involving regular expressions supplied by users, including patterns used in CI/CD configurations.

GitLab disclosed four related CVEs between September 23 and October 21, 2026, and released patches to address them.

The vulnerabilities differed in their exploitation requirements and severity ratings:

• The first two vulnerabilities, disclosed on September 23, required an authenticated account and received CVSS scores of 9.9.
• CVE-2026-97229, disclosed on October 12, and CVE-2026-110264, disclosed on October 21, did not require authentication and received the maximum CVSS score of 10.0.

CVE-2026-110264 affects GitLab versions dating back to 7.0, according to the reported findings.

A security researcher operating under the handle joaxcar reported all four vulnerabilities through GitLab’s bug bounty program.

As of October 23, 2026, none of the four vulnerabilities was listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog.

Why Regular Expression Compilation Can Be Dangerous

Regular expressions are widely used to validate input, search text, extract information, and process strings. However, compiling attacker-controlled patterns can introduce security risks when the underlying regular expression engine contains memory-handling flaws.

In this case, specially crafted patterns can trigger memory corruption while Ruby processes them. Under the right conditions, this could potentially allow an attacker to execute code within the privileges of the affected application.

Applications that accept user-defined patterns, provide customizable filtering rules, or allow users to submit regular expressions through APIs should review their input-handling logic carefully.

Developers should avoid passing untrusted strings directly into regular expression constructors and should use appropriate validation or alternative matching strategies wherever possible.

Ruby Has Not Assigned Separate CVE Identifiers

Ruby has not requested its own CVE identifiers for these fixes, at least for now. Instead, the project has advised users to track the issues using the four CVE identifiers assigned through GitLab.

This creates a potential challenge for vulnerability management systems that rely exclusively on CVE records to identify affected software.

The GitLab CVE records identify GitLab as the affected product, which means scanners checking installed Ruby versions may not automatically associate those records with the underlying Onigmo issues.

Ruby has assigned CVE identifiers to similar vulnerabilities in 2022 and 2024, despite the longstanding risks associated with compiling untrusted regular expressions.

The project’s documentation currently describes untrusted regular expression patterns primarily as a denial-of-service risk. Ruby has indicated that it may update its advisory if separate CVE identifiers are requested.

Organizations should therefore review the Ruby security advisory and the applicable GitLab notices rather than relying solely on automated CVE matching.

GitLab Administrators Should Install Patched Releases

Administrators operating self-managed GitLab instances should ensure that their installations include the fix for CVE-2026-110264.

GitLab released the patch on October 21, 2026, and backported it to the following versions:

• 19.5.1
• 19.4.3
• 19.3.6
• 19.2.9
• 19.1.9
• 19.0.10
• 18.11.13

GitLab.com is already running a patched version, while GitLab Dedicated customers using recent internal releases do not need to take additional action, according to the published information.

Because GitLab bundles its own Ruby runtime, installing the relevant fixed GitLab release applies the necessary patch without requiring administrators to update a separate system-wide Ruby installation.

GitLab has also published detection rules that self-managed administrators can use to identify potential exploitation attempts.

Recommendations for Developers and System Administrators

To reduce exposure to these vulnerabilities, organizations should take the following precautions:

1. Upgrade Ruby: Install Ruby 4.0.9, 3.4.12, or 3.3.13, depending on the deployed branch.
2. Update GitLab: Apply the appropriate patched release if operating a self-managed GitLab instance.
3. Review regular expression handling: Identify code that constructs regular expressions from user input, API parameters, CI/CD configurations, or other untrusted sources.
4. Avoid unsafe workarounds: Do not rely on Regexp.timeout or pattern-length restrictions as substitutes for the security updates.
5. Migrate unsupported versions: Move away from Ruby 3.2 and older unsupported branches, or use a verified vendor-provided security backport where applicable.
6. Monitor suspicious activity: Review application logs and available detection rules for signs of attempts to exploit the vulnerabilities.

Conclusion

The latest Ruby security releases address serious flaws in Onigmo that can cause memory corruption when specially crafted regular expressions are compiled. Under certain conditions, successful exploitation could lead to code execution.

Although the issues were identified through GitLab, the underlying risks affect other Ruby applications that compile attacker-controlled patterns.

Organizations should prioritize upgrading to the fixed Ruby versions, review how their applications process user-supplied regular expressions, and ensure that GitLab installations are running patched releases. Systems using unsupported Ruby branches require particular attention because they may not receive upstream security fixes.