Ruby — Three Critical Regular Expression Engine Bugs Fixed, Impacting GitLab (CVE-2026-110264)

Publication date: October 23, 2026
Category: Vulnerability / Software Security

Introduction

The Ruby project has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three critical vulnerabilities located in Onigmo, the regular expression engine built directly into the language. These underlying defects are responsible for four critical security flaws that GitLab patched over the past month. The findings, identified and reported by security researcher joaxcar through GitLab’s bug bounty program, demonstrate how specially crafted regular expression patterns can trigger memory corruption during compilation, leading to remote code execution (RCE) on affected servers.

What is CVE-2026-110264 and CVE-2026-97229? (General Analysis)

The discovered vulnerabilities involve severe memory management flaws within the Onigmo engine when compiling complex or malicious regular expressions. Specifically, CVE-2026-110264 and CVE-2026-97229 represent integer overflow flaws (CWE-190) triggered when an application compiles attacker-controlled strings into regular expressions.

  • CVE-2026-110264: A critical vulnerability rated with a CVSS v3.1 score of 10.0 (Critical), using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. It requires no prior authentication or user interaction, affecting multiple versions of GitLab CE/EE from 7.0 onwards across the 18.x and 19.x release branches.
  • CVE-2026-97229: A critical vulnerability rated with a CVSS v3.1 score of 10.0 (Critical), using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, associated with insufficient validation of regular expressions injected via CI/CD configurations.

The risk is not restricted to GitLab alone; any Ruby application that processes external input and compiles it via methods such as Regexp.new, Regexp.union, Regexp.compile, or direct interpolation (/#{input}/) remains exposed to memory corruption and potential arbitrary code execution.

How Does It Work? (Technical Analysis)

The exploitation mechanism relies on the deliberate manipulation of internal data structures processed by the underlying regex engine:

  • Initial Input Flow: The attacker supplies a precisely structured character string (for instance, via CI/CD pipeline configurations in GitLab that the system automatically compiles).
  • Memory Corruption via Overflow: During the compilation phase of the regular expression pattern, the Onigmo engine incorrectly calculates the required memory buffer sizes due to an integer overflow (CWE-190). As memory allocations overflow, out-of-bounds writes occur, corrupting adjacent data structures in the application’s heap.
  • Code Execution: By selectively altering execution flow or adjacent memory pointers through the malicious pattern, the attacker bypasses interpreter isolation boundaries, culminating in the execution of arbitrary commands with the privileges of the server process (in this case, the GitLab environment or the underlying Ruby application).

Affected Systems / Environments

The impact spans both Ruby language implementations and GitLab instances bundling the vulnerable engine:

  • Affected Ruby Versions: Versions prior to 4.0.9, 3.4.12, and 3.3.13. (Note: Older branches such as Ruby 3.2 reached end-of-life on April 1, 2026, and will not receive official patches).
  • Affected GitLab Versions: GitLab CE/EE versions 7.0 up to 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.
CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-110264 CWE-190 (Integer Overflow) Remote Code Execution 10.0 (Critical) AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-97229 CWE-190 (Integer Overflow) Remote Code Execution 10.0 (Critical) AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Ruby Update: Developers utilizing Ruby must immediately upgrade to versions 4.0.9, 3.4.12, or 3.3.13 depending on their active support branch.
  • GitLab Update: Administrators of self-hosted GitLab instances must apply the platform’s security patch releases (versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1), as GitLab bundles its own patched copy of Ruby.
  • Development Best Practices: Categorically avoid compiling regular expressions based on input provided by unauthenticated users or unvalidated data (Regexp.new(untrusted_input)). Defensive configurations such as setting Regexp.timeout or capping pattern length are ineffective against these low-level memory flaws.

Detection

System administrators and Blue Team units should inspect audit and activity logs for anomalies in CI/CD configurations or unauthorized requests attempting to inject complex patterns.

“Compiling regular expression patterns from untrusted input in vulnerable engines exposes systems to direct memory space manipulation, enabling unauthenticated threat actors to compromise the entire underlying server.”

It is recommended to deploy official detection rules and artifact blocking patterns provided by GitLab security repositories to identify exploitation attempts at the Onigmo worker level.

Wrapping Up

The disclosure of these critical vulnerabilities in the Onigmo regular expression engine highlights the inherent risks of insecure external input processing within high-level programming languages. The prompt response by the Ruby project and GitLab through multi-version patch releases emphasizes the critical necessity of keeping both development runtimes and enterprise platforms updated to neutralize remote code execution vectors driven by memory corruption.

References