Ruby · Disclosed

Ruby Patches Regex Bugs Behind Four Critical GitLab RCE Flaws

Oct 22, 2026 · 1 min read

Ruby has fixed three regular expression compilation bugs that underpinned four critical GitLab RCE flaws: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Fixes shipped on October 23, 2026 in Ruby 4.0.9, 3.4.12 and 3.3.13; Ruby 3.2, end-of-life since 2026-04-01, gets no fix. According to Ruby, the risk is limited to applications that compile regexes from attacker-controlled strings; update Ruby and review GitLab.

By HIFY Radar newsroom Updated 10/26/2026 01:11 PM Get this every day →← Back to the feed 4 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The Ruby team fixed three bugs in the language's regular expression engine, according to The Hacker News. Those bugs underpinned four critical remote code execution flaws in GitLab, tracked as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Fixes are in versions 4.0.9, 3.4.12 and 3.3.13, released October 23, 2026.

Why it matters

According to Ruby itself, the risk exists only when an application builds regular expressions from attacker-supplied text, a scenario that includes the GitLab cases. In that scenario the flaw enables remote code execution, with risk of a compromised server and exposed data. Ruby 3.2, unsupported since April 1, 2026, will receive no fix, leaving older systems without an official patch path.

What to do

Upgrade Ruby to 4.0.9, 3.4.12 or 3.3.13, depending on the branch in use. Confirm GitLab is on a version patched by the vendor. Check whether any in-house application compiles regexes from user input.

For the technical team

CVE: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264
Affected: Ruby (CRuby / Onigmo regex engine) · Ruby 4.0 before 4.0.9; Ruby 3.4 before 3.4.12; Ruby 3.3 before 3.3.13; Ruby 3.2 and older unfixed (3.2 EOL since 2026-04-01). Limited to applications that compile regexes from attacker-controlled strings.
Exploitation: Sources report no in-the-wild exploitation and no public proof of concept. Reference severity: critical, per the Ruby advisory. Current stage: disclosed and patched.
Fix: Ruby 4.0.9, 3.4.12 and 3.3.13, released October 23, 2026. No fixed release for Ruby 3.2 and older (EOL). Per the 3.3.13 notice, the regex fix landed as an exception because the 3.3 series is in the security maintenance phase.
Vector: CRuby (Onigmo) regex engine, flaw in regular expression compilation. Exploitation condition, per Ruby: the application compiles a regular expression from an attacker-controlled string. Outside this condition the flaw does not apply.
More details: Three Ruby regex bugs map to four critical GitLab CVEs (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). The Ruby 4.0.9 notice ties CVE-2026-110264 to a specific Regexp compilation bug. The Ruby advisory cites a Rapid7 analysis describing CVE-2026-97229 as a CI/CD regex integer overflow in GitLab, and cites GitLab advisories with Critical Patch Releases (including 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13). Ruby 3.3.13 also fixes CVE-2026-80212 and CVE-2026-80213 by updating the default resolv gem to 0.3.2.