The **Ruby** programming language has issued critical updates to its runtime, specifically targeting three bugs within **Onigmo**, its integrated regular expression engine. These vulnerabilities have already been exploited and patched by **GitLab** over the past month, highlighting their severity and potential impact across the broader Ruby ecosystem. **GitLab**'s investigation revealed that specially crafted regular expression patterns could corrupt memory during compilation, potentially enabling code execution on affected servers. **Ruby**'s advisory confirms that any application building regular expressions from untrusted input is vulnerable, extending the risk beyond just **GitLab**'s environment.  ### Affected Applications and Remediation According to **Ruby**'s advisory, an application is vulnerable if it compiles a regular expression from a string controlled by an attacker. This occurs when such a string is passed to `Regexp.new`, `Regexp.union`, `Regexp.compile`, or interpolated into a pattern like `/#{input}/`. Applications that only use developer-defined regular expressions are not affected. Users are urged to upgrade to the following versions: * **Ruby** 4.0: Upgrade to [4.0.9](https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/) * **Ruby** 3.4: Upgrade to [3.4.12](https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/) * **Ruby** 3.3: Upgrade to [3.3.13](https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/) It's crucial to note that **Ruby** 4.0.8 does not include the fix for **CVE-2026-110264**, making version 4.0.9 the minimum recommended for 4.0 users. **Ruby** versions 3.2 and earlier will not receive patches as they have reached end-of-life. Users on these older versions are advised to migrate to 3.4 or 4.0. For those unable to upgrade immediately, the primary mitigation is to cease compiling regular expressions from untrusted input. Counter-intuitively, setting `Regexp.timeout` or capping pattern length offers no protection against these specific bugs. ### How the Bugs Impacted GitLab **GitLab**'s platform compiles user-supplied regular expressions, for instance, in CI/CD configurations. This attack vector allowed crafted patterns to corrupt memory during compilation. **GitLab** addressed four critical **CVEs** between September 23 and October 21, each resolved by shipping a patched **Ruby** version within its releases. Two of the initial vulnerabilities, disclosed on September 23, required a logged-in account and were rated 9.9 out of 10. The later two, **CVE-2026-97229** (October 12) and **CVE-2026-110264** (October 21), were even more severe, requiring no authentication and receiving a maximum **CVSS** score of 10.0. **CVE-2026-110264** affects all **GitLab** versions from 7.0 onwards. The researcher `joaxcar` reported all four flaws through **GitLab**'s bug bounty program. As of October 23, these vulnerabilities were not listed in **CISA**'s Known Exploited Vulnerabilities catalog. ### The Absence of Ruby CVEs (For Now) **Ruby** has opted not to request its own **CVE** identifiers for these fixes, at least for the time being, directing users to track the issues via **GitLab**'s four **CVE** numbers. This approach creates a potential blind spot for security scanners that rely on **CVE** records, as **GitLab**'s **CVEs** only list **GitLab** as the affected product, not the underlying **Ruby** component. Historically, **Ruby** has assigned **CVE** numbers for similar regular expression-related vulnerabilities, such as **CVE-2022-28738** and **CVE-2024-27282**, despite the long-standing advice against using untrusted input for regex compilation. The **Ruby** documentation currently only describes untrusted patterns as a denial-of-service risk. **Ruby** has stated it will update its advisory if it requests any **CVE** identifiers in the future. ### Guidance for GitLab Administrators Self-managed **GitLab** instances must apply the release that fixes **CVE-2026-110264**. **GitLab** shipped this fix on October 21 and backported it to versions as far back as 18.11.13. Affected versions requiring an upgrade include: * 19.5.1 * 19.4.3 * 19.3.6 * 19.2.9 * 19.1.9 * 19.0.10 * 18.11.13 **GitLab.com** and **GitLab Dedicated** tenants on recent internal releases are already protected. Since **GitLab** bundles its own **Ruby** copy, installing one of these fixed **GitLab** versions automatically applies the necessary patch. Additionally, **GitLab** has published [detection rules](https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md) to help self-managed administrators identify potential exploitation attempts.