Ruby Patches Regex Engine Behind Four Critical GitLab RCEs

Ruby patched three bugs in Onigmo, the regex engine built into the language, after a security researcher traced four critical GitLab remote code execution flaws to the same underlying memory-corruption issues.

Patches landed Friday in Ruby 4.0.9, 3.4.12, and 3.3.13. If you are on Ruby 3.2 or earlier, there is no fix: that branch hit end of life on April 1, 2026, and no security backport is coming.

The bugs

All three Onigmo flaws cause memory corruption when Ruby compiles a specially crafted regular expression. The exploitable path runs through Regexp.new, Regexp.union, Regexp.compile, or inline interpolation (/#{input}/) fed attacker-controlled data. Ruby has not assigned CVE identifiers to the underlying engine bugs; the exploitable impact in GitLab carries four CVEs, two of them at CVSS 10.0.

Regexp.timeout and pattern-length limits are not reliable mitigations. Update Ruby.

GitLab impact

CVE-2026-110264 (CVSS 10.0, patched October 21) and CVE-2026-97229 (CVSS 10.0, patched October 12) each require no authentication on self-managed GitLab instances. Two additional flaws from September reached CVSS 9.9 but required a valid logged-in session. GitLab.com and recent Dedicated instances are already patched.

Self-managed installations need one of these GitLab versions or later:

• 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

GitLab has published detection rules for exploitation attempts. The researcher credited under the handle “joaxcar” reported the flaw path via GitLab’s bug bounty program.

Previous 0dayNews coverage: CVE-2026-110264 RCE affects 12 years of releases and CVE-2026-97229 CI/CD regex RCE.

Scope beyond GitLab

GitLab is the confirmed exploitation target, but the vulnerable code is Ruby itself. Any Ruby application that compiles regular expressions from user-controlled input sits on the same attack surface. Audit for Regexp.new(user_input), Regexp.union(*user_array), and string interpolation inside regex literals before assuming no exposure.

What to do

1. Update Ruby to 4.0.9, 3.4.12, or 3.3.13.
2. If running self-managed GitLab, apply the listed patch versions even if you already updated Ruby.
3. If you are stuck on Ruby 3.2 or earlier and cannot upgrade, treat every Regexp.new call receiving untrusted input as an unmitigable risk until you can.