Ruby patches Onigmo regex engine behind four critical GitLab RCEs

Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 to fix three bugs in Onigmo, its built-in regular-expression engine. Those bugs are the root cause of the four unauthenticated GitLab RCEs disclosed since late September. Because the flaws live in Ruby's standard regex compiler, the exposure is not GitLab's alone: any Ruby application that compiles a pattern from attacker-controlled input is potentially affected.

The three Onigmo bugs

Per Ruby's advisory:

1. A double free when parsing a pattern fails after an alternation (#13332).
2. An integer overflow in the size of a compiled pattern (#19020).
3. An overflow of internal IDs in a pattern with many repeats (#16801).

Ruby 4.0.9, 3.4.12 and 3.3.13 contain all three fixes. Partial fixes landed earlier, so version matters: Ruby 4.0.8 still lacks the #16801 fix (the one mapped to CVE-2026-110264). The Hacker News reports Ruby 3.2 reached end of life on April 1, 2026 and will not receive a fix.

Ruby did not request its own CVE IDs. Track the issues by GitLab's numbers:

• CVE-2026-89078 — double free in the regex parser (GitLab 19.4.1).
• CVE-2026-93577 — integer overflow in the regex compiler (GitLab 19.4.1).
• CVE-2026-97229 — integer overflow in the CI/CD regex compiler, CVSS 10.0 (GitLab 19.4.2).
• CVE-2026-110264 — integer overflow in the regex compiler, CVSS 10.0, reaching GitLab from 7.0 onward (GitLab 19.5.1).

What triggers it

An application is exposed if it compiles a regex from an attacker-controlled string — Regexp.new, Regexp.union, Regexp.compile, or interpolation such as /#{input}/. GitLab is the headline victim because its CI/CD and search features do exactly this, but the pattern is common in validators, routers and query builders across the Ruby ecosystem.

Exploitation status

Per The Hacker News, none of the four CVEs was in CISA's KEV catalog as of Oct 23, and there is no public PoC or in-the-wild report. GitLab published detection rules self-managed admins can run against their logs.

What to do today

1. Upgrade Ruby to 4.0.9, 3.4.12 or 3.3.13 (or later). 4.0.x users specifically need 4.0.9 — 4.0.8 is still exposed to CVE-2026-110264.
2. GitLab self-managed: upgrade to a fixed patch release (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13). They bundle the patched Ruby; GitLab.com already runs it.
3. If you can't upgrade Ruby now, stop compiling regexes from untrusted input. Ruby warns that Regexp.timeout does not stop these bugs and that capping pattern length is unreliable — neither is a substitute for the patch.
4. Audit your code for Regexp.new, Regexp.union, Regexp.compile and /#{...}/ built from request data.

Context

We covered the GitLab side of this as the CVEs landed: CVE-2026-97229 in the CI/CD regex compiler and CVE-2026-110264 reaching every version since 7.0. Today's release reframes all four: they were never GitLab-specific logic bugs but flaws in the language's regex engine. Reporter joaxcar found them through GitLab's bug bounty, and the fix had to ship from Ruby. If you run anything in Ruby that turns user input into a pattern, this is your advisory too — not just GitLab's.