Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language.
The bugs lie behind four critical security flaws that GitLab patched over the past month.
GitLab warned customers ten days ago about another critical remote code execution vulnerability (CVE-2026-97229) with a 10/10 CVSS base score in the CI/CD Regular Expression Compiler, reported by the same security researcher.
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language.
GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.
Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its list of actively exploited flaws and ordered federal agencies to secure their systems within three days.
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab.
In its advisory , Ruby said an application is affected only if it compiles a regular expression from a string an attacker controls.
Since November 2021, CISA has flagged five GitLab flaws used in the wild, including one exploited in ransomware attacks.
GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and warned users to patch their instances immediately.
What happened
The bugs lie behind four critical security flaws that GitLab patched over the past month.
GitLab warned customers ten days ago about another critical remote code execution vulnerability (CVE-2026-97229) with a 10/10 CVSS base score in the CI/CD Regular Expression Compiler, reported by the same security researcher.
What changed
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language.
GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.
Who is affected
Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its list of actively exploited flaws and ordered federal agencies to secure their systems within three days.
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
Why it matters
Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab.
In its advisory , Ruby said an application is affected only if it compiles a regular expression from a string an attacker controls.
Technical details
Since November 2021, CISA has flagged five GitLab flaws used in the wild, including one exploited in ransomware attacks.
GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and warned users to patch their instances immediately.
An earlier release from the same week, 4.0.8, does not include the fix for one of the flaws, CVE-2026-110264 , so 4.0 users should install 4.0.9.
Response
Self-managed GitLab instances need the release that fixes CVE-2026-110264.
Last month, it fixed another maximum-severity GitLab CE/EE flaw (CVE-2026-85706) that lets unauthenticated attackers read sensitive data (e.g., credentials and other secrets) from vulnerable servers.
What security teams should do
Ruby said it will update its advisory if it requests any CVE identifiers.
It found that crafted patterns could corrupt memory as Ruby compiled them, and it issued four CVEs between September 23 and October 21 , fixing each by shipping a patched Ruby.
Attribution
The Hacker News: Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language.
BleepingComputer: GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.