Ruby fixes regular-expression compilation bugs enabling RCE on GitLab servers

Ruby released 4.0.9, 3.4.12 and 3.3.13 to fix double-free and integer-overflow bugs in its Onigmo regular-expression engine that GitLab found could enable remote code execution on GitLab servers. The issues correspond to CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Applications are exposed when they compile attacker-controlled regular-expression strings; Regexp.timeout and pattern-length limits do not reliably prevent exploitation because the flaws occur during compilation. Ruby recommends upgrading or avoiding compilation of untrusted patterns and has asked users to track the issues under GitLab’s CVE identifiers while it considers separate identifiers.

GitLab merged related backports into its Omnibus 19-1-stable, 19-4-stable and 19-5-stable branches. The 19.4 and 19.5 changes add repeat-ID overflow checks for Ruby 3.3, 3.4 and 4.0; the 19.1 backport also addresses repeat-range double-free and compiled-program size handling. Validation for 19.1 included a successful Enterprise Edition build, passing subset tests and ARM64 smoke tests on Ruby 3.3.11, but the full Enterprise Edition QA suite could not be triggered. The 19.4 and 19.5 pipelines passed with warnings, with package-build validation still questioned in review. Operators should upgrade affected Ruby runtimes and verify that their deployed GitLab release contains the fixes rather than treating merged backports alone as confirmation of remediation.