Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
Ruby releases 4.0.9, 3.4.12 and 3.3.13 fix regular expression engine bugs that can corrupt memory when compiling attacker-controlled patterns. Applications are affected only if they compile regular expressions from attacker-controlled strings.
CVE context updated · The publisher announcement is unchanged.
Announced
Machine-extracted · Revision 2Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers.
Ruby
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
- Affected versions
- Not stated in this extraction
- Fixed versions
- 4.0.9
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
3.4.12We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
3.3.13We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
- Prerequisites
- These bugs are reached only when an application compiles a regular expression from a string that an attacker controls
These bugs are reached only when an application compiles a regular expression from a string that an attacker controls
- Related CVEs
- CVE-2026-89078
CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLab 19.4.1)
CVE-2026-93577CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler (GitLab 19.4.1)
CVE-2026-97229CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression Compiler (GitLab 19.4.2)
CVE-2026-110264CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1)
Publisher severity
No explicit severity was extracted.