Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical Git Lab RCE Flaws
Summary: Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, its built-in regular expression engine, which underlie four critical GitLab flaws patched between September 23 and October 21. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiled it, potentially leading to code execution, and the two October flaws, CVE-2026-97229 and CVE-2026-110264, required no account and were rated 10.0.
What you should know: CVE-2026-110264 reaches every GitLab version from 7.0 onward, and Ruby has not requested its own CVE identifiers, so GitLab's records name only GitLab as the affected product and a scanner checking them against installed Ruby versions has nothing to match.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-110264CVE-2026-97229
- Related
- Critical Git Lab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Cyber Risks ·⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More Cyber Risks ·CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 29, 2026