Ruby Releases Security Fixes for Four GitLab-Linked Remote Code Execution Issues

Ruby has released three updated versions to address bugs in its regular expression engine that were linked to four security vulnerabilities reported by GitLab. The issues could potentially allow attackers to execute code remotely on GitLab servers when specially crafted regular expression patterns are compiled.

The fixes are included in Ruby 4.0.9, Ruby 3.4.12, and Ruby 3.3.13, announced on October 23, 2026. The Ruby team recommends upgrading to these versions or later to address the underlying bugs.

The announcement identifies four GitLab CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. The vulnerabilities involve memory-management errors and integer overflows in Ruby's regular expression compilation process.

For developers maintaining Ruby applications, the key concern is whether their software compiles regular expressions using patterns supplied by untrusted users.

What happened?

Ruby's regular expression engine, Onigmo, processes patterns that developers use to search, match, and validate text. Applications can compile these patterns dynamically using methods such as Regexp.new, Regexp.union, and Regexp.compile.

GitLab discovered that specially crafted patterns could trigger memory corruption while Ruby compiled them. Under the affected conditions, this could potentially be exploited to execute code remotely on GitLab servers.

GitLab patched the Ruby versions it distributes and published four CVE identifiers covering the issues. The Ruby team subsequently released fixes for the underlying bugs in Ruby itself.

The distinction matters because a patch applied by GitLab to its own software does not automatically update a separate Ruby application or installation. Developers and administrators need to check which Ruby runtime their own systems use.

The four vulnerabilities explained

The four CVEs relate to three underlying bug patterns in Ruby's regular expression compiler and parser.

What do these errors mean?

• Double free: A program incorrectly attempts to release the same memory allocation more than once. This can corrupt memory and potentially create a security risk.

• Integer overflow: A numerical calculation exceeds the range that a particular integer representation can hold. In a compiler, this can cause incorrect size calculations or internal identifiers.

• Compiled pattern size error: Ruby incorrectly calculates the size required to represent a compiled regular expression.

• Internal ID overflow: A pattern containing many repetitions can cause internal identifiers used during compilation to exceed their intended range.

These are bugs in the process Ruby uses to compile regular expressions, rather than a general flaw in every regular expression used by Ruby applications.

Who is affected?

The Ruby team says the bugs are reached only when an application compiles a regular expression from a string controlled by an attacker.

This can happen when applications pass user-supplied patterns to methods such as:

Regexp.new(input)
Regexp.union(input)
Regexp.compile(input)

It can also happen when untrusted input is interpolated into a regular expression literal, such as:

/#{input}/

The security concern depends on how the application handles input. Applications that use only regular expressions written by their own developers are not affected by these specific bugs, according to the Ruby announcement.

For example, an application that allows users to submit custom search patterns or accepts patterns through CI/CD configuration may need closer review if it compiles those patterns dynamically.

This does not mean every application using Ruby, GitLab, or regular expressions is automatically vulnerable. Teams should check whether their application processes attacker-controlled patterns.

Which Ruby versions contain the fixes?

Ruby released the following versions on October 23, 2026, with fixes for all four GitLab-linked issues.

The Ruby team recommends upgrading to these versions or later.

The announcement also documents when individual fixes first appeared in each release series. Ruby 4.0.0 contains the fix for the double-free issue, Ruby 4.0.8 contains the fixes for the compiled-pattern size overflows, and Ruby 4.0.9 adds the fix for internal ID overflow. The complete set is included in Ruby 4.0.9.

Ruby 3.3 is in its security maintenance phase, where releases normally focus on security fixes. The team included these regular expression fixes in Ruby 3.3.13 as an exception because GitLab assigned CVEs to the issues.

Why a timeout or pattern-length limit is not enough

Developers may try to control regular expression risks by limiting execution time or restricting pattern length. However, the Ruby team explicitly warns that neither approach reliably protects against these bugs.

Regexp.timeout is intended to limit how long regular expression matching can take. It does not prevent the memory corruption issues that can occur while a pattern is being compiled.

Similarly, restricting pattern length is not a reliable defence because some of these bugs can be triggered by short patterns.

The recommended fix is to upgrade Ruby. If upgrading is not possible, the Ruby team advises avoiding the compilation of regular expressions from untrusted input.

What developers and administrators should do

Teams maintaining Ruby applications should take the following steps.

1. Identify the Ruby runtime. Check the version used by development environments, production servers, containers, and deployment pipelines.

2. Review dynamic regular expression compilation. Search application code for Regexp.new, Regexp.union, Regexp.compile, and regular expression literals that interpolate external input.

3. Assess input sources. Determine whether users, external integrations, configuration files, or CI/CD inputs can supply patterns that the application compiles.

4. Upgrade to a fixed version. Use Ruby 4.0.9, 3.4.12, or 3.3.13, or a later applicable release.

5. Validate the deployment. Confirm that the intended runtime is active after deployment and that the application continues to function as expected.

6. Update vulnerability tracking. Use the four GitLab CVE identifiers when reviewing scanner results and tracking remediation.

If an immediate upgrade is not possible, avoid compiling regular expressions from untrusted input, as advised by the Ruby team. A timeout or a pattern-length restriction should not be treated as a substitute for the fixes.

What the Ruby team said about CVE tracking

The Ruby team has not requested separate CVE identifiers for these fixes at this time. The announcement explains that Ruby has historically considered compiling and using regular expressions created from untrusted input unsafe, while its documentation has primarily discussed untrusted patterns in the context of denial-of-service risks.

The team plans to discuss how this behaviour should be documented and whether this type of issue should be treated as a vulnerability in Ruby itself.

Until that position is clarified, the announcement recommends using GitLab's four CVE identifiers when tracking these issues, including in security scanners.

Industry perspective

The announcement highlights a broader software security lesson: vulnerabilities can emerge not only from application code, but also from the way an application uses an underlying language runtime.

For development teams, this means reviewing input-handling logic alongside routine dependency and runtime updates. Applications that allow users to define patterns or submit configuration need particular care when those values are passed into compilation functions.

This is an industry-level observation based on the announced issues, not a claim that all applications using Ruby or GitLab are exposed.

Conclusion

Ruby's October 23 release announcement addresses four GitLab-linked security issues involving regular expression compilation. The underlying bugs include a double-free error and integer overflows that could lead to memory corruption and potentially remote code execution under affected conditions.

Developers should upgrade to Ruby 4.0.9, 3.4.12, or 3.3.13, or a later applicable release. Where an upgrade cannot be completed immediately, avoiding compilation of regular expressions from untrusted input is the mitigation recommended by the Ruby team.

The main priority is to identify applications that compile externally controlled patterns and ensure they run a version containing all the relevant fixes.