As reported by The Hacker News, Ruby has shipped patched releases for three memory corruption flaws in Onigmo, its regular expression engine, that powered four Critical GitLab remote code execution vulnerabilities disclosed between September 23 and October 21. Two of the GitLab CVEs carry a CVSS 10.0 score and require no authentication. The underlying mechanism, however, is not GitLab-specific — and that is the part defenders need to internalize quickly.
Vulnerability Details
| Field | Detail |
|---|---|
| Affected software | Ruby (Onigmo regex engine) versions 4.0 prior to 4.0.9, 3.4 prior to 3.4.12, 3.3 prior to 3.3.13; Ruby 3.2 and earlier (EOL, no fix) |
| Trigger condition | Application compiles a regular expression from attacker-controlled input via Regexp.new, Regexp.union, Regexp.compile, or interpolation (/#{input}/) |
| Impact | Memory corruption during regex compilation → potential remote code execution in the host process |
| Patch available | Yes — Ruby 4.0.9, 3.4.12, 3.3.13 |
| Active exploitation in the wild | Not listed in CISA KEV catalog as of October 23, 2026; no confirmed in-the-wild exploitation reported |
| Known downstream CVEs | GitLab CVE-2026-97229 (CVSS 10.0, unauth), CVE-2026-110264 (CVSS 10.0, unauth, affects GitLab 7.0+), plus two CVSS 9.9 authenticated flaws disclosed September 23 |
The most dangerous detail in Ruby's advisory is what it rules out:
Regexp.timeoutdoes not prevent these bugs, and capping pattern length is unreliable because short patterns can trigger the corruption. The only reliable mitigation short of patching is to stop compiling regex from untrusted input entirely.
Why the Blast Radius Is Larger Than GitLab
GitLab was the discovery vector because it compiles user-supplied regex in CI/CD configurations — a documented, supported feature. But any application that lets a user influence a regex pattern is exposed. That class includes search backends that accept regex syntax, content filters, log-processing pipelines, routing engines, and plenty of SaaS features that quietly interpolate user input into patterns. Defenders should not assume GitLab is the only victim; they should assume the pattern exists somewhere in their own stack unless proven otherwise.
Equally concerning is the CVE attribution gap. Ruby has not requested its own CVE identifiers and currently directs users to track the four GitLab CVEs. That means any vulnerability scanner or SBOM workflow keyed on Ruby package metadata may miss the fix entirely. Security teams operating on the assumption that "Ruby has no open CVE" should treat that signal as unreliable until Ruby issues identifiers or the upstream distributions re-tag the packages.
Who Is Most Exposed
- Self-hosted GitLab instances — especially internet-facing ones running versions prior to the patched releases. CVE-2026-110264 affects every GitLab version from 7.0 onward and requires no account.
- Applications on Ruby 3.2 or earlier — these are end-of-life and will never receive a fix. Organizations still on 3.2.x (which reached EOL April 1, 2026) are running a permanently vulnerable regex engine.
- Apps that interpolate user input into regex — search features, WAF-style filters, dynamic routing, and CI tooling are prime candidates.
Shield53 Recommendations
- Patch Ruby immediately to 4.0.9, 3.4.12, or 3.3.13 depending on your branch. Note that 4.0.8 does not include the fix for CVE-2026-110264 — do not assume the latest 4.0.x is sufficient.
- Upgrade any Ruby 3.2 or earlier deployments to a supported branch. There is no patch and no workaround for EOL versions.
- Audit code for attacker-influenced regex compilation. Search for
Regexp.new,Regexp.union,Regexp.compile, and interpolation in routes, controllers, and library code. Treat any user-controllable string reaching those calls as a defect. - Do not rely on
Regexp.timeoutor input length limits as compensating controls for this class of bug. They address ReDoS, not memory corruption during compilation. - Update GitLab self-hosted instances to the latest patched release and verify that the embedded Ruby has been replaced, not just the GitLab package.
- Add detection for anomalous regex patterns in inputs that reach regex compilation — unusual character classes, repeated quantifiers, and deeply nested groups are consistent with crafted payloads targeting Onigmo.
