Ruby 4.0.9, 3.4.12 and 3.3.13 Patch Onigmo Bugs That Enabled GitLab RCE
Ruby 4.0.9, 3.4.12 and 3.3.13 fix Onigmo regular expression engine memory bugs that GitLab found allowed remote code execution through attacker-controlled patterns, and GitLab has published four CVEs for them.
Ruby 4.0.9, 3.4.12, and 3.3.13 are out with Onigmo regular expression engine bug fixes. GitLab discovered that these bugs enabled remote code execution on GitLab servers and published four CVEs for the issues.
GitLab compiles user-supplied regular expressions using Regexp.new, such as patterns in CI configuration. Specially crafted patterns corrupted memory during compilation and enabled code execution. GitLab shipped patches in its bundled Ruby and assigned CVE-2026-89078 for a double free fixed in GitLab 19.4.1, CVE-2026-93577 for an integer overflow fixed in 19.4.1, CVE-2026-97229 for an integer overflow in the CI/CD regular expression compiler fixed in 19.4.2, and CVE-2026-110264 for an integer overflow fixed in 19.5.1.
Three Ruby changes address the four CVEs. Change #13332 fixes a double free when parsing a pattern fails after an alternation. Change #19020 fixes an integer overflow in the compiled pattern size. Change #16801 fixes an internal ID overflow in patterns with many repeats.
Applications compiling attacker-controlled text are exposed. This includes Regexp.new, Regexp.union, Regexp.compile, or interpolating input into a literal like /#{input}/. Regexp.timeout and capping pattern length provide no protection.
The Ruby project recommends upgrading to 4.0.9, 3.4.12, 3.3.13, or later. Ruby 3.3 is in security maintenance, but version 3.3.13 includes these fixes as an exception. Ruby has not requested CVE identifiers. Johan Carlsson discovered the integer overflow fixed by #19020 through GitLab's bug bounty program.