{"id":184003,"date":"2026-10-26T11:41:01","date_gmt":"2026-10-26T09:41:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-ruby-ekspluatiruemaya-dlya-udalyonnogo-vypolneniya-koda-v-gitlab"},"modified":"2026-10-26T11:41:08","modified_gmt":"2026-10-26T09:41:08","slug":"ruby-vulnerability-exploited-for-remote-code-execution-in-gitlab","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ruby-vulnerability-exploited-for-remote-code-execution-in-gitlab","title":{"rendered":"Vulnerability in Ruby exploited for remote code execution in GitLab","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases of the Ruby programming language versions 3.3.13, 3.4.12, and 4.0.9 have been published, addressing a critical vulnerability (CVE-2026-110264) that leads to integer overflow when compiling specially crafted regular expressions. This vulnerability can be exploited to attack projects written in Ruby that use external data in their regular expressions. Among other things, it has been confirmed that the vulnerability can be exploited for remote code execution on the GitLab collaborative development platform. The issue has also been blocked in updates to GitLab versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The vulnerability has been assigned a severity level of 10 out of 10. <\/p>\n
The vulnerability exists in the Onigmo regular expressions engine and leads to an overflow of internal identifiers when compiling a pattern with a large number of repetitions. The issue manifests only in applications using external data in regular expressions processed through methods like Regexp.new, Regexp.union, and Regexp.compile, or literals like «\\\/#{input}\\\/». Limiting the size of the regular expression or the time it takes to process it through the Regexp.timeout method does not mitigate the vulnerability, as short patterns can be used for the attack. <\/p>\n
In GitLab, the vulnerability can be exploited by an unauthenticated user due to the substitution of external data in a regular expression. Details of the exploitation method are not yet disclosed (according to GitLab's rules, information becomes available 30 days after the release of the fix), meanwhile, attempts to carry out attacks on GitLab users are already being reported online. Indirect signs of an ongoing attack may include an increase in the number of crashes of the Ruby interpreter and a rise in errors in the logs related to timeout issues occurring while processing org files.<\/p>\n