Heist/ feed

Security feed

patchSecurity fix · UnratedRuby

Regexp compilation fixes related to GitLab CVEs

Ruby releases 4.0.9, 3.4.12, and 3.3.13 fix bugs in Ruby’s regular expression engine that GitLab found could be used for attacks.

Announced

Ruby · Fixed in 4.0.9, 3.4.12, 3.3.13CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for...

Ruby

Ruby 4.0.9, 3.4.12 and 3.3.13
Affected versions
Not stated in this extraction
Fixed versions
4.0.9
Ruby 4.0.9, 3.4.12 and 3.3.13
3.4.12
Ruby 4.0.9, 3.4.12 and 3.3.13
3.3.13
Ruby 4.0.9, 3.4.12 and 3.3.13
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-89078
CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-93577
CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-97229
CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-110264
CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264

Publisher severity

No explicit severity was extracted.

Event
#19321 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedRuby

Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264

Ruby 4.0.9, 3.4.12, and 3.3.13 were released to fix bugs in Ruby’s regular expression engine (Onigmo).

Announced

Ruby · Fixed in Ruby 4.0.9, 3.4.12, 3.3.13CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

They fix several bugs in Ruby’s regular expression engine (Onigmo)

Ruby

Ruby 4.0.9, 3.4.12 and 3.3.13
Affected versions
Not stated in this extraction
Fixed versions
Ruby 4.0.9
We have released Ruby 4.0.9
3.4.12
Ruby 4.0.9, 3.4.12 and 3.3.13
3.3.13
Ruby 4.0.9, 3.4.12 and 3.3.13
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-89078
CVE-2026-89078
CVE-2026-93577
CVE-2026-93577
CVE-2026-97229
CVE-2026-97229
CVE-2026-110264
CVE-2026-110264

Publisher severity

No explicit severity was extracted.

Event
#19320 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchLinked Critical CVEFix availableRuby

Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264

Ruby releases 4.0.9, 3.4.12 and 3.3.13 fix regular expression engine bugs that can corrupt memory when compiling attacker-controlled patterns. Applications are affected only if they compile regular expressions from attacker-controlled strings.

Announced

Ruby · Fixed in 4.0.9, 3.4.12, 3.3.13CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers.

Ruby

We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
Affected versions
Not stated in this extraction
Fixed versions
4.0.9
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
3.4.12
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
3.3.13
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
Prerequisites
These bugs are reached only when an application compiles a regular expression from a string that an attacker controls
These bugs are reached only when an application compiles a regular expression from a string that an attacker controls
Related CVEs
CVE-2026-89078
CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLab 19.4.1)
CVE-2026-93577
CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler (GitLab 19.4.1)
CVE-2026-97229
CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression Compiler (GitLab 19.4.2)
CVE-2026-110264
CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1)

Publisher severity

No explicit severity was extracted.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-89078 · Critical

GitLab

Fix relationship
Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-93577 · Critical

GitLab

Fix relationship
Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-97229 · Critical

GitLab

Fix relationship
Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
Event
#19319 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedRuby

Ruby 3.4.12 Released

Ruby 3.4.12 fixes bugs in the regular expression engine that GitLab found could be used for security issues.

Announced

Ruby · Fixed in 3.4.12CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on.

Ruby

Ruby 3.4.12 has been released.
Affected versions
Not stated in this extraction
Fixed versions
3.4.12
Ruby 3.4.12 has been released.
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-89078
GitLab’s CVE-2026-89078
CVE-2026-93577
CVE-2026-93577
CVE-2026-97229
CVE-2026-97229
CVE-2026-110264
CVE-2026-110264

Publisher severity

No explicit severity was extracted.

Event
#19318 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedRuby

Ruby 4.0.9 Released

Ruby 4.0.9 includes fixes for bugs in the regular expression engine that could be used for security issues. Ruby 3.4.12 and 3.3.13 were also released with fixes.

Announced

Ruby · Fixed in 4.0.9, 3.4.12, 3.3.13CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation

Ruby

Ruby 4.0.9 has been released.
Affected versions
Not stated in this extraction
Fixed versions
4.0.9
Ruby 4.0.9 has been released.
3.4.12
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
3.3.13
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-89078
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-93577
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-97229
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-110264
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264

Publisher severity

No explicit severity was extracted.

Event
#19317 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedRuby

Ruby 3.3.13 Released

Ruby 3.3.13 includes security fixes, including an updated resolv gem and fixes for Regexp compilation bugs.

Announced

Ruby · Fixed in 3.3.13resolv · Fixed in 0.3.2CVE-2026-80212CVE-2026-80213CVE-2026-89078CVE-2026-93577CVE-2026-97229CVE-2026-110264
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Ruby 3.3.13 has been released. This release includes security fixes.

Ruby

Ruby 3.3.13 has been released.
Affected versions
Not stated in this extraction
Fixed versions
3.3.13
Ruby 3.3.13 has been released.
Prerequisites
Not stated in this extraction

resolv

This release updates the default gem resolv to 0.3.2
Affected versions
Not stated in this extraction
Fixed versions
0.3.2
This release updates the default gem resolv to 0.3.2
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-80212
Security advisories: CVE-2026-80212 and CVE-2026-80213
CVE-2026-80213
Security advisories: CVE-2026-80212 and CVE-2026-80213
CVE-2026-89078
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-93577
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-97229
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
CVE-2026-110264
Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264

Publisher severity

No explicit severity was extracted.

Event
#19315 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement