Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

The vulnerabilities were discovered by GitLab, which found that specially crafted regular expression patterns could corrupt memory while Ruby compiles them. This memory corruption could potentially lead to remote code execution on affected servers. Ruby emphasized that any application that builds regular expressions from text controlled by attackers is vulnerable, not just GitLab.

Affected Applications

According to Ruby's advisory, an application is only affected if it compiles a regular expression from a string an attacker controls. This occurs when a program passes such a string to Regexp.new, Regexp.union, or Regexp.compile, or places it inside a pattern through interpolation like /#{input}/. Applications using only developer-written regex patterns remain safe.

Ruby has provided specific upgrade paths for affected versions: Ruby 4.0 users should upgrade to 4.0.9, Ruby 3.4 to 3.4.12, and Ruby 3.3 to 3.3.13. Notably, Ruby 3.2 and earlier versions will not receive fixes as 3.2 reached end of life on April 1, 2026.

GitLab Response

GitLab discovered the vulnerabilities and issued four CVEs between September 23 and October 21, fixing each by shipping a patched Ruby version. The first two vulnerabilities, disclosed on September 23, each required a logged-in account and were rated 9.9 out of 10. The two from October, CVE-2026-97229 and CVE-2026-110264, required no account and received the maximum severity rating of 10.0.

Mitigation Steps

For those unable to immediately upgrade, Ruby advises against compiling regular expressions from untrusted input. Two common defenses—setting Regexp.timeout and capping pattern length—are ineffective against these specific vulnerabilities. Self-managed GitLab instances need the release that fixes CVE-2026-110264, which GitLab shipped on October 21 and backported to version 18.11.13.

GitLab has also published detection rules that administrators can use to identify potential exploitation attempts. The vulnerabilities were reported by researcher joaxcar through GitLab's bug bounty program and were not listed in CISA's Known Exploited Vulnerabilities catalog as of October 23.