Ruby Releases 4.0.9, 3.4.12, and 3.3.13 to Fix Critical Onigmo Vulnerabilities
Ruby has released patches for three Onigmo engine bugs that allow for potential remote code execution via untrusted input in regular expressions.
Ruby versions 4.0.9, 3.4.12, and 3.3.13 were released on October 23, 2026, to fix three Onigmo regular expression engine bugs that can cause memory corruption and remote code execution when applications pass untrusted input into Regexp.new, Regexp.union, Regexp.compile, or interpolated literals like /#{input}/.
GitLab discovered the flaws and issued four critical CVEs between September 23 and October 21, 2026: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. Two of these CVEs received a 10.0 CVSS score because they are exploitable without authentication, with CVE-2026-110264 impacting GitLab versions back to 7.0. The underlying issues are a double free during parsing failure after alternation, an integer overflow regarding compiled pattern size, and an internal ID overflow in patterns containing many repeats. According to security reports, neither Regexp.timeout nor pattern-length limits prevent the bugs.
An analysis from Infield indicates that vulnerability exposure reaches back through every release from 1.9 to 3.2, which will receive no patches. Ruby 3.3 received backported fixes as an exception due to the assigned CVEs, while Ruby 4.0 users must upgrade to version 4.0.9 since 4.0.8 lacks the patch for CVE-2026-110264. Teams running unsupported versions must either upgrade to a patched release or ensure user input never reaches regular expression construction, as CISA's assessment listed exploitation as none as of October 25, 2026.