CVE-2026-97229

Ruby has released updated versions (4.0.9, 3.4.12, and 3.3.13) to address three critical bugs in its Onigmo regular expression engine, which were exploited to enable remote code execution (RCE) in GitLab. The vulnerabilities stem from memory corruption during regex compilation when processing attacker-controlled input, affecting any Ruby application that compiles untrusted regular expressions. Four critical CVEs were issued by GitLab, two of which (CVE-2026-97229 and CVE-2026-110264) are rated 10.0 and exploitable without authentication, impacting all GitLab versions since 7.0. Although Ruby did not assign its own CVEs, it directed users to track the issues via GitLab's advisories.

GitLab has disclosed and patched a maximum-severity vulnerability, CVE-2026-110264, in its Regular Expression Compiler that could allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers via a specially crafted regular expression. The flaw stems from an integer overflow weakness and affects multiple versions of GitLab Community Edition (CE) and Enterprise Edition (EE). Users are urged to upgrade immediately, as the vulnerability could lead to full system compromise. This follows recent critical GitLab vulnerabilities, including CVE-2026-97229 and CVE-2026-85706, the latter of which was added to CISA's known exploited vulnerabilities list.