Security · November 1, 2026
Ruby fixes three critical flaws linked to GitLab vulnerabilities
The Ruby team has released versions 4.0.9, 3.4.12, and 3.3.13 to address three bugs in the Onigmo regex engine. These flaws can lead to the execution of malicious code on affected servers.
These bugs are the root cause of several vulnerabilities recently discovered in GitLab, which is based on Ruby. The risk extends to any Ruby application that generates regular expressions from external input. The Ruby team stated that users who only use self written patterns are not affected. The errors occur during the compilation phase, where Ruby translates a pattern into an internal program, rather than during the matching process.
In the case of GitLab, the service compiles regular expressions from user inputs, such as those found in CI/CD configurations. Security researcher Johan Carlsson reported four vulnerabilities through a bug bounty program: CVE-2026-89078 and CVE-2026-93577, which have a CVSS score of 9.9, and CVE-2026-97229 and CVE-2026-110264, which have a maximum score of 10.0. The latter two can be exploited without authentication. GitLab patched these between September 23 and October 21 by patching its own bundled Ruby. The most recent update affects all GitLab versions since version 7.0 from 2014.
The Ruby team mapped the four CVEs to three specific bugs. CVE-2026-89078 is caused by a double free during pattern reading. CVE-2026-93577 and CVE-2026-97229 result from an integer overflow when calculating the size of the compiled program. CVE-2026-110264 is caused by an overflow of internal counters in patterns with very many repetitions.
None of the three fixes are new. The double free fix has been in the development branch since May 2025 and in a release version since Ruby 4.0.0. The fix for the counters was completed in April 2026, and the program size fix in September 2026. These only recently reached release versions. Ruby 4.0.8, released October 22, included the program size fix as a routine update without mentioning security. Version 4.0.9 followed a day later with the final fix. Stable branches 3.4 and 3.3 received all three fixes at once. Ruby 3.3, which usually only receives security corrections, was updated as an exception because GitLab assigned CVEs. No updates are available for Ruby 3.2 or older.
If exploited, an attacker's code could run with the permissions of the Ruby process, granting access to the database, environment secrets, and the file system. A single attempt is more likely to cause a process crash, leading to a denial of service without authentication. Neither GitLab nor Ruby have reported active attacks.
Existing protections such as Regexp.timeout are ineffective because they only interrupt matching, not the compilation where these errors occur. The Ruby team also noted that limiting pattern length is not a reliable solution, as some errors can be triggered by short patterns. The Ruby project has not requested its own CVE identifiers because it has traditionally viewed the compilation of external patterns as inherently unsafe, suggesting the vulnerability lies within the application rather than the interpreter.