The Ruby team released 4.0.9, 3.4.12 and 3.3.13 on Oct 23. They fix the bugs in Ruby's regex engine, Onigmo, that GitLab turned into remote code execution: a double free after a failed alternation (GitLab's CVE-2026-89078), an integer overflow in compiled-pattern size (CVE-2026-93577 and CVE-2026-97229) and an overflow of internal IDs in patterns with many repeats (CVE-2026-110264). GitLab had already patched the Ruby it bundles; these releases carry the fixes to everyone else.

• Affected: only apps that compile a regex from attacker-controlled text, via Regexp.new, Regexp.union, Regexp.compile or interpolation like /#{input}/. Apps that only use developer-written patterns are not affected.
• No stopgap: Ruby says Regexp.timeout does not help, and length limits are unreliable because some triggers are short patterns. Upgrade, or stop compiling untrusted patterns.
• Ruby 3.3.13 also updates the default resolv gem to 0.3.2 for CVE-2026-80212 and CVE-2026-80213.
• Ruby has not requested its own CVE IDs yet, so scanners may not flag this; use GitLab's IDs to track it.