[CLSTR]
< Back to all clusters
[TECHNOLOGY] · 3 sources

started · updated

Ruby releases patches for critical Onigmo regex engine vulnerabilities

Ruby programming language Onigmo GitLab remote code execution cybersecurity vulnerabilities

Ruby has released security updates in versions 4.0.9, 3.4.12, and 3.3.13 to address four critical vulnerabilities within its Onigmo regular expression engine. These flaws, originally discovered by GitLab, can allow remote code execution (RCE) when an application compiles regular expressions from untrusted, attacker-controlled input.

The vulnerabilities include CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. One flaw, CVE-2026-110264, is rated with a maximum severity of 10.0 and affects all GitLab versions from 7.0 onward, requiring no authentication to exploit. Other issues involve integer overflows and double-free errors during pattern parsing and compilation.

Applications are at risk if they use methods such as Regexp.new, Regexp.union, or Regexp.compile with external strings, or use string interpolation within a regular expression literal. Ruby noted that setting Regexp.timeout or capping pattern length are not effective defenses against these specific exploits.

Ruby 3.2 and earlier versions will not receive these patches as they reached end-of-life on April 1, 2026. Developers using older versions are encouraged to migrate to Ruby 3.4 or 4.0.

Entities

GitLab · Onigmo · Ruby

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

Ruby Patches Critical Regex Flaws After GitLab CVEs [bitnewsbot.com]
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws [cybernoz.com]
Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 | Ruby [www.ruby-lang.org]