Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

Ruby has released updated versions (4.0.9, 3.4.12, and 3.3.13) to address three critical bugs in its Onigmo regular expression engine, which were exploited to enable remote code execution (RCE) in GitLab. The vulnerabilities stem from memory corruption during regex compilation when processing attacker-controlled input, affecting any Ruby application that compiles untrusted regular expressions. Four critical CVEs were issued by GitLab, two of which (CVE-2026-97229 and CVE-2026-110264) are rated 10.0 and exploitable without authentication, impacting all GitLab versions since 7.0. Although Ruby did not assign its own CVEs, it directed users to track the issues via GitLab's advisories.

AI-extracted · verify before operational use