Ruby Fixes Three Onigmo Flaws That CVE Scanners May Miss
The Ruby team has released Ruby 4.0.9, 3.4.12 and 3.3.13 to fix three vulnerabilities in the Onigmo regular-expression engine. Heise reported the releases on October 30, 2026. Applications that compile regular expressions from external input can expose the flaw to attackers, potentially allowing code to run with the privileges of the Ruby process or repeatedly crashing request-handling processes.
The affected operation is pattern compilation, not only the later matching step. A web application may pass a search parameter directly to Regexp.new, allowing a requester to control the pattern Ruby must compile. The reported failure modes include a double free, an integer overflow while calculating the compiled program size, and an overflow of internal counters for patterns with many repetitions.
Connection to GitLab
GitLab exposed the same underlying Ruby problems through features that compile regular expressions from user input, including CI/CD configuration handling. Security researcher Johan Carlsson reported four GitLab vulnerabilities: CVE-2026-89078 and CVE-2026-93577 were rated CVSS 9.9, while CVE-2026-97229 and CVE-2026-110264 received a CVSS score of 10.0. The latter two were described as exploitable without authentication. GitLab fixed the issues between September 23 and October 21 by updating its bundled Ruby, and the update affects GitLab versions released since 7.0.
No active attacks have been reported by GitLab or Ruby. A single exploit attempt is more likely to crash the process than to achieve code execution, according to the report, but repeated attempts can turn that failure into an unauthenticated denial-of-service condition. If code execution succeeds, the attacker receives the access available to the Ruby process, including potentially application databases, environment secrets and the file system.
Updates and workarounds
Ruby users should update to 4.0.9, 3.4.12 or 3.3.13 as appropriate, then select the new interpreter in the project and rebuild its gems. Ruby 3.2 and older receive no further updates. A timeout is not a sufficient workaround because it interrupts an overly long match, whereas these failures occur while the pattern is being compiled. Limiting pattern length is also not reliable. Until an update is possible, the Ruby team advises not compiling patterns supplied by external users.
Applications that only need literal text search can avoid the regex engine and compare strings instead. Where user input must be placed inside a fixed regular expression, it should be escaped with Regexp.escape. Operators should also account for bundled runtimes: Docker images need a new tag, while distribution packages and bundles such as GitLab Omnibus may deliver Ruby through their own product updates.
The Ruby project has not assigned its own CVE identifiers to these three defects. As a result, software inventories that match installed components against CVE databases may not flag an affected Ruby 3.4.11 installation. The four GitLab identifiers are currently the tracking references recommended in the report.