Ruby versions 4.0.9, 3.4.12, and 3.3.13 address three memory corruption bugs in the Onigmo regular expression engine.
Developers handling untrusted input in regex patterns should review the updates.
Which programs are affected?
According to the official update, the problem is not limited to GitLab. Any application that reads text from an external source and converts it into a text search rule is at risk, as attackers could exploit this process to execute code on the systems hosting the application. In contrast, programs that use exclusively rules written by their creators are not affected.
Older versions 3.2 and below will not receive any updates, as their support ended in April 2026. At the same time, it was emphasized that measures such as limiting execution time or limiting text length cannot prevent this specific problem.
How the problems were revealed
GitLab published four security reports between September 23 and October 21, each patched with the inclusion of patched versions of Ruby. The first two issues required account login and were given an extremely high severity rating. The next two, CVE-2026-97229 and CVE-2026-110264, were published on October 12 and 21, respectively, did not require any account access and received the maximum possible score of 10.0, with the latter affecting every version of GitLab since 7.0.
READ ALSO
New warning from PHP about low-risk issue in certain settings
All findings were submitted by an independent researcher through GitLab’s bug bounty program. As of October 23, none of the four issues were on the official list of known attacks by U.S. authorities. Ruby also did not request its own identifiers for its packages, instead encouraging users to track issues via GitLab’s issue numbers.
What should administrators do?
GitLab standalone administrators should immediately upgrade to the new packages released on October 21—including versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and the 18.11.13 patch—. Official cloud services and Dedicated tenants are already running the patched packages and do not need to do anything. Additionally, GitLab has published detection rules that administrators can use to check for exploit attempts on their systems.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)