{"schema_version":"1","data":[{"id":52471,"advisory_id":"e36704a3-a880-4241-8227-7f89e41f07a8","revision":2,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","source_published_at":"2026-10-23T03:11:22+00:00","published_at":"2026-10-25T14:45:08.495603+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264","summary":"Ruby releases 4.0.9, 3.4.12 and 3.3.13 fix regular expression engine bugs that can corrupt memory when compiling attacker-controlled patterns. Applications are affected only if they compile regular expressions from attacker-controlled strings.","evidence":"They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers.","products":[{"name":{"value":"Ruby","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},"prerequisites":[{"value":"These bugs are reached only when an application compiles a regular expression from a string that an attacker controls","evidence":"These bugs are reached only when an application compiles a regular expression from a string that an attacker controls"}],"fixed_versions":[{"value":"4.0.9","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.4.12","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.3.13","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLab 19.4.1)"},{"value":"CVE-2026-93577","evidence":"CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler (GitLab 19.4.1)"},{"value":"CVE-2026-97229","evidence":"CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression Compiler (GitLab 19.4.2)"},{"value":"CVE-2026-110264","evidence":"CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-89078","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89078","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"cve":"CVE-2026-93577","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93577","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"cve":"CVE-2026-97229","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97229","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"cve":"CVE-2026-110264","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110264","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":true},{"id":19321,"advisory_id":"f7014744-52ae-48d3-b5be-43a1c13fbfc9","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/12/ruby-4-1-0-preview1-released/","source_published_at":"2026-10-12T00:00:00+00:00","published_at":"2026-10-25T02:48:22.923641+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Regexp compilation fixes related to GitLab CVEs","summary":"Ruby releases 4.0.9, 3.4.12, and 3.3.13 fix bugs in Ruby’s regular expression engine that GitLab found could be used for attacks.","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for...","products":[{"name":{"value":"Ruby","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},"prerequisites":[],"fixed_versions":[{"value":"4.0.9","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},{"value":"3.4.12","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},{"value":"3.3.13","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-93577","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-97229","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-110264","evidence":"CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19320,"advisory_id":"f047bfc5-af0a-4a49-9668-7c65b3ec7153","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/22/ruby-4-0-8-released/","source_published_at":"2026-10-22T06:54:51+00:00","published_at":"2026-10-25T02:47:22.518248+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264","summary":"Ruby 4.0.9, 3.4.12, and 3.3.13 were released to fix bugs in Ruby’s regular expression engine (Onigmo).","evidence":"They fix several bugs in Ruby’s regular expression engine (Onigmo)","products":[{"name":{"value":"Ruby","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},"prerequisites":[],"fixed_versions":[{"value":"Ruby 4.0.9","evidence":"We have released Ruby 4.0.9"},{"value":"3.4.12","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"},{"value":"3.3.13","evidence":"Ruby 4.0.9, 3.4.12 and 3.3.13"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"CVE-2026-89078"},{"value":"CVE-2026-93577","evidence":"CVE-2026-93577"},{"value":"CVE-2026-97229","evidence":"CVE-2026-97229"},{"value":"CVE-2026-110264","evidence":"CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19319,"advisory_id":"e36704a3-a880-4241-8227-7f89e41f07a8","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","source_published_at":"2026-10-23T03:11:22+00:00","published_at":"2026-10-25T02:46:23.13701+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264","summary":"Ruby releases 4.0.9, 3.4.12 and 3.3.13 fix regular expression engine bugs that can corrupt memory when compiling attacker-controlled patterns. Applications are affected only if they compile regular expressions from attacker-controlled strings.","evidence":"They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers.","products":[{"name":{"value":"Ruby","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},"prerequisites":[{"value":"These bugs are reached only when an application compiles a regular expression from a string that an attacker controls","evidence":"These bugs are reached only when an application compiles a regular expression from a string that an attacker controls"}],"fixed_versions":[{"value":"4.0.9","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.4.12","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.3.13","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLab 19.4.1)"},{"value":"CVE-2026-93577","evidence":"CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler (GitLab 19.4.1)"},{"value":"CVE-2026-97229","evidence":"CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression Compiler (GitLab 19.4.2)"},{"value":"CVE-2026-110264","evidence":"CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-89078","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-89078","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"cve":"CVE-2026-93577","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.9,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93577","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"cve":"CVE-2026-97229","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"GitLab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97229","relationship":"fixes","known_exploited":false,"relationship_evidence":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19318,"advisory_id":"ca0db6b7-2631-49df-a8d8-a88731d67082","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/","source_published_at":"2026-10-23T03:50:27+00:00","published_at":"2026-10-25T02:43:21.263064+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 3.4.12 Released","summary":"Ruby 3.4.12 fixes bugs in the regular expression engine that GitLab found could be used for security issues.","evidence":"This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on.","products":[{"name":{"value":"Ruby","evidence":"Ruby 3.4.12 has been released."},"prerequisites":[],"fixed_versions":[{"value":"3.4.12","evidence":"Ruby 3.4.12 has been released."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"GitLab’s CVE-2026-89078"},{"value":"CVE-2026-93577","evidence":"CVE-2026-93577"},{"value":"CVE-2026-97229","evidence":"CVE-2026-97229"},{"value":"CVE-2026-110264","evidence":"CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19317,"advisory_id":"82b0713b-23f7-4767-b40f-d309deddf2bb","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/","source_published_at":"2026-10-23T03:11:22+00:00","published_at":"2026-10-25T02:40:22.833852+00:00","extraction_method":"llm","technologies":["ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 4.0.9 Released","summary":"Ruby 4.0.9 includes fixes for bugs in the regular expression engine that could be used for security issues. Ruby 3.4.12 and 3.3.13 were also released with fixes.","evidence":"Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation","products":[{"name":{"value":"Ruby","evidence":"Ruby 4.0.9 has been released."},"prerequisites":[],"fixed_versions":[{"value":"4.0.9","evidence":"Ruby 4.0.9 has been released."},{"value":"3.4.12","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."},{"value":"3.3.13","evidence":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-89078","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-93577","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-97229","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-110264","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19315,"advisory_id":"141b25b5-6292-4e7e-b52e-b1ec72d82e72","revision":1,"source_id":"ruby","source_url":"https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/","source_published_at":"2026-10-23T04:24:46+00:00","published_at":"2026-10-25T02:32:23.015644+00:00","extraction_method":"llm","technologies":["resolv","ruby"],"cve_ids":["CVE-2026-110264","CVE-2026-80212","CVE-2026-80213","CVE-2026-89078","CVE-2026-93577","CVE-2026-97229"],"event_types":["patch"],"payload":{"kind":"patch","title":"Ruby 3.3.13 Released","summary":"Ruby 3.3.13 includes security fixes, including an updated resolv gem and fixes for Regexp compilation bugs.","evidence":"Ruby 3.3.13 has been released. This release includes security fixes.","products":[{"name":{"value":"Ruby","evidence":"Ruby 3.3.13 has been released."},"prerequisites":[],"fixed_versions":[{"value":"3.3.13","evidence":"Ruby 3.3.13 has been released."}],"affected_versions":[]},{"name":{"value":"resolv","evidence":"This release updates the default gem resolv to 0.3.2"},"prerequisites":[],"fixed_versions":[{"value":"0.3.2","evidence":"This release updates the default gem resolv to 0.3.2"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-80212","evidence":"Security advisories: CVE-2026-80212 and CVE-2026-80213"},{"value":"CVE-2026-80213","evidence":"Security advisories: CVE-2026-80212 and CVE-2026-80213"},{"value":"CVE-2026-89078","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-93577","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-97229","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"},{"value":"CVE-2026-110264","evidence":"Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":52471,"next_before":19315}