Corrective releases of the Ruby programming language versions 3.3.13, 3.4.12, and 4.0.9 have been published, addressing a critical vulnerability (CVE-2026-110264) that leads to integer overflow when compiling specially crafted regular expressions. This vulnerability can be exploited to attack projects written in Ruby that use external data in their regular expressions. Among other things, it has been confirmed that the vulnerability can be exploited for remote code execution on the GitLab collaborative development platform. The issue has also been blocked in updates to GitLab versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The vulnerability has been assigned a severity level of 10 out of 10.
The vulnerability exists in the Onigmo regular expression engine and leads to the overflow of internal identifiers when compiling patterns with a large number of repetitions. The issue manifests only in applications that use external data in regular expressions processed through methods such as Regexp.new, Regexp.union, and Regexp.compile, or literals of the form ‘/#{input}/’. Restricting the size of the regular expression or the time it takes to process it via the Regexp.timeout method does not block the vulnerability, as short patterns can still be used for an attack.
In GitLab, the vulnerability can be exploited by an unauthenticated user due to the substitution of external data in a regular expression. Details of the exploitation method are not yet disclosed (according to GitLab's rules, information becomes available 30 days after the release of the fix), meanwhile, attempts to carry out attacks on GitLab users are already being reported online. Indirect signs of an ongoing attack may include an increase in the number of crashes of the Ruby interpreter and a rise in errors in the logs related to timeout issues occurring while processing org files.
In addition to CVE-2026-110264, three more vulnerabilities have been fixed in the regular expression engine: CVE-2026-89078 (double memory release when failing to parse a pattern after it has been changed), CVE-2026-93577, and CVE-2026-97229 (integer overflows when calculating the size of the compiled pattern).
Source: opennet.ru
