Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

Ruby has shipped versions 4.0.9, 3.4.12 and 3.3.13 to close three memory-corruption bugs in Onigmo, its bundled regex engine, after discovering they were the root cause of four critical GitLab vulnerabilities fixed over the past month. GitLab found that attacker-supplied patterns, such as those in CI/CD configuration, could corrupt memory during regex compilation and lead to remote code execution; the flaws include CVE-2026-97229 and CVE-2026-110264, both rated a maximum CVSS of 10.0, with CVE-2026-110264 affecting every GitLab release since version 7.0. Ruby warns the underlying bugs hit any application that compiles a regex from untrusted input via Regexp.new, Regexp.union, Regexp.compile or string interpolation, and notes that Regexp.timeout and pattern-length limits do not mitigate the risk. Ruby has not yet assigned its own CVE numbers to these fixes and advises tracking them via GitLab's four CVE identifiers instead, while self-managed GitLab administrators should update to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13 to get the patched Ruby bundled inside.