---
title: Ruby 4.0.9, 3.4.12 and 3.3.13 fix the Onigmo regex memory bugs behind GitLab's CVSS 10 RCEs, for any app that compiles user-supplied patterns | ctxsec
url: https://ctxsec.com/items/ruby-4-0-9-3-4-12-3-3-13-onigmo-regexp-fixes
description: ""
status: "confirmed (ruby-lang.org, Oct 23); Ruby has not assigned its own CVEs, track by GitLab's"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/ruby-4-0-9-3-4-12-3-3-13-onigmo-regexp-fixes.md)

confirmed (ruby-lang.org, Oct 23); Ruby has not assigned its own CVEs, track by GitLab's

2026-10-23

### Ruby 4.0.9, 3.4.12 and 3.3.13 fix the Onigmo regex memory bugs behind GitLab's CVSS 10 RCEs, for any app that compiles user-supplied patterns

The Ruby team released **4.0.9**, **3.4.12** and **3.3.13** on Oct 23. They fix the bugs in Ruby's regex engine, Onigmo, that GitLab turned into remote code execution: a double free after a failed alternation (GitLab's CVE-2026-89078), an integer overflow in compiled-pattern size (CVE-2026-93577 and CVE-2026-97229) and an overflow of internal IDs in patterns with many repeats (CVE-2026-110264). GitLab had already patched the Ruby it bundles; these releases carry the fixes to everyone else.

- **Affected:** only apps that compile a regex from attacker-controlled text, via `Regexp.new`, `Regexp.union`, `Regexp.compile` or interpolation like `/#{input}/`. Apps that only use developer-written patterns are not affected.
- **No stopgap:** Ruby says `Regexp.timeout` does not help, and length limits are unreliable because some triggers are short patterns. Upgrade, or stop compiling untrusted patterns.
- Ruby 3.3.13 also updates the default `resolv` gem to 0.3.2 for CVE-2026-80212 and CVE-2026-80213.
- Ruby has not requested its own CVE IDs yet, so scanners may not flag this; use GitLab's IDs to track it.

Sources: [Ruby: Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 (Oct 23)](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/) · [Ruby 4.0.9 released](https://www.ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-released/) · [Ruby 3.4.12 released](https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/) · [Ruby 3.3.13 released](https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-released/)