Ruby security update fixes flaws behind GitLab RCEs
The Ruby security update covering versions 4.0.9, 3.4.12 and 3.3.13 fixes three bugs behind four critical GitLab remote code execution (RCE) flaws. RCE means an attacker may be able to run commands or software on an affected server. The underlying problems are in Onigmo, the regular expression engine built into Ruby, and can affect applications beyond GitLab when they create search patterns from attacker-controlled text.
A regular expression is a pattern that software uses to find or match text. According to Ruby's advisory, an application is exposed only when it compiles such a pattern from a string controlled by an attacker. This can happen when software passes the string to Regexp.new, Regexp.union or Regexp.compile. It can also occur through interpolation, which inserts a supplied value directly into a pattern, as in /#{input}/. Regular expressions written entirely by an application's own developers are not affected.
GitLab identified that a specially prepared pattern could cause memory corruption while Ruby compiled it. Memory corruption occurs when software incorrectly changes or accesses the area where running programs store data. In these cases, the damage could potentially lead to code execution on GitLab servers. The issue matters to hosting providers and website operators because any Ruby application that accepts user-controlled regular expressions may expose the same underlying engine bugs.
Ruby 4.0 users should upgrade to 4.0.9, Ruby 3.4 users to 3.4.12, and Ruby 3.3 users to 3.3.13. Releases 3.4.12 and 3.3.13 are the first versions in their respective series to contain any of the three fixes. Ruby 4.0.8, released earlier in the same week, does not contain the correction for CVE-2026-110264, so installing 4.0.8 is not sufficient.
Ruby 3.2 and older branches will not receive the repairs. Ruby 3.2 reached end of life, meaning it no longer receives supported updates, on April 1, 2026, with 3.2.11 as its final release. Ruby recommends moving affected installations to the 3.4 or 4.0 series. Organisations that cannot upgrade immediately should stop compiling regular expressions from untrusted input until they can install a corrected release.
Two possible safeguards do not address these flaws. Ruby says Regexp.timeout, a setting intended to limit how long pattern matching can run, does not prevent the memory corruption. Restricting the number of characters in a pattern is also unreliable because even short patterns can trigger the bugs. This distinction is important for application owners who may previously have treated untrusted regular expressions only as a performance or denial-of-service concern. Denial of service means making an application unavailable or too slow to use.
GitLab accepts user-provided regular expressions in places including continuous integration and continuous delivery (CI/CD) configurations, which automate the building, testing and release of software. The company issued four Common Vulnerabilities and Exposures (CVE) identifiers between September 23 and October 21, releasing a Ruby build with patches for each issue. The first two flaws, disclosed on September 23, require a logged-in account and each received a severity score of 9.9 out of 10.
The other two flaws do not require an account. CVE-2026-97229 was disclosed on October 12, while CVE-2026-110264 followed on October 21. Both were assigned the maximum severity score of 10.0. GitLab says CVE-2026-110264 affects every version of its product from 7.0 onward. An independent researcher reported all four vulnerabilities through GitLab's bug bounty program.
As of October 23, none of the four vulnerabilities appeared in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog. Ruby has not requested separate CVE identifiers for the three Onigmo bugs, at least for now, and has advised users to follow the four GitLab identifiers instead. Ruby said it would revise its advisory if that position changes.
The absence of Ruby-specific CVE records creates a visibility problem for automated scanning. GitLab's records identify GitLab as the affected product, leaving a scanner that compares those records with installed Ruby versions without a direct match. Ruby assigned CVE identifiers to similar fixes in 2022 and 2024, although compiling regular expressions from untrusted text has long been considered unsafe. Its documentation currently describes untrusted patterns only as a denial-of-service risk.
Administrators of self-managed GitLab installations should apply a release containing the fix for CVE-2026-110264. GitLab shipped the correction on October 21 in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Because GitLab includes its own copy of Ruby, upgrading GitLab to one of those releases also installs the patched runtime. GitLab.com is already running the corrected version, and GitLab said Dedicated tenants using recent internal releases do not need to act.
GitLab has also released detection rules that self-managed administrators can use to search for evidence of exploitation attempts. For organisations seeking outside support with software maintenance and infrastructure security, AEU-I provides security-first IT, infrastructure and consulting. The immediate priority remains checking the actual Ruby or self-managed GitLab version in use, rather than relying on pattern timeouts, length limits or vulnerability scans that may not associate the GitLab identifiers with Ruby.