# Ruby Patches Onigmo Regex Bugs That Let Attackers Own GitLab Servers Without Logging In **Source:** https://glitchwire.com/news/ruby-patches-onigmo-regex-bugs-that-let-attackers-own-gitlab-servers-without-log/ **Published:** 2026-10-23T17:07:36.297Z **Author:** Security Desk ยท Glitchwire **Categories:** Security, Tech ## Summary Four CVEs, three bugs, 12 years of vulnerable GitLab releases. Ruby 4.0.9, 3.4.12, and 3.3.13 fix the integer overflows and double-free that made it possible. ## Article The Ruby core team released [Ruby 4.0.9, 3.4.12, and 3.3.13](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/) on October 23, fixing bugs in the Onigmo regular expression engine that GitLab says enabled unauthenticated remote code execution on self-managed servers. Any application that builds a regex from user input should upgrade. GitLab discovered the flaws when security researcher Johan "joaxcar" Carlsson reported a string of critical vulnerabilities through its HackerOne bug bounty program. The bugs are not in GitLab's Rails code. They sit in Onigmo, the C library Ruby uses to compile regular expressions. GitLab ships its own Ruby, so it patched the engine internally before upstream Ruby published fixes. "GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with Regexp.new," the Ruby team wrote in its advisory. "GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab servers." ## The bugs Ruby's announcement lists three distinct flaws. A double-free when parsing a pattern fails after an alternation operator. An integer overflow when computing the size of a compiled pattern. And an overflow of internal IDs in patterns with many repeat quantifiers. The last one, which underlies CVE-2026-110264, occurs because Onigmo stores repeat-group IDs in a signed 16-bit field. A pattern crafted with more than 32,767 repetitions wraps the counter negative, and the matcher writes out of bounds. GitLab assigned four CVE identifiers to exploits that use these bugs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. The last carries CVSS 10.0 and affects every self-managed GitLab release from version 7.0, which shipped in June 2014. One attack path reaches the vulnerable code through GitLab's Org-mode renderer, where a TODO keyword controlled by an attacker gets passed into Regexp.new. ## Why Ruby 3.3 got an exception Ruby 3.3 is in security maintenance, meaning it normally receives only patches for vulnerabilities in Ruby itself. The core team made an exception because the bugs, while not assigned CVEs by Ruby, enabled critical exploits in a major downstream project. Takashi Kokubun, who posted the release, urged developers running any app that compiles regexes from untrusted strings to upgrade immediately. Pattern length limits and Regexp.timeout do not help. The corruption happens at compile time, before matching begins, and some patterns that trigger the bugs are short. ## GitLab's side GitLab shipped its own fix on October 21 in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The company [backported the patch](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) further than its normal three-version window because of the severity. GitLab.com and GitLab Dedicated are already patched. Self-managed administrators who upgraded on October 12 for CVE-2026-97229 need to upgrade again. SOC Prime researchers noted that "a compromised GitLab server can create downstream supply chain risk even after the original server is remediated." GitLab installations often hold proprietary code, deployment credentials, and CI/CD secrets. The company has published two threat detections to help administrators identify exploitation attempts. As of October 22, neither GitLab nor CISA had confirmed active exploitation. No public proof-of-concept has surfaced. The [Node.js Brotli decoder RCE](/news/nodejs-patches-brotli-decoder-flaw-that-permits-remote-code-execution/) patched earlier this year followed a similar pattern: critical memory corruption, no known exploitation, rapid patching cycle. Ruby has not requested its own CVE identifiers for the fixes. The team's advisory notes that compiling regexes from untrusted input has never been considered safe. GitLab's architecture made that assumption anyway, and 12 years of releases were vulnerable. --- **About Glitchwire** Glitchwire is an independent technology news publication covering artificial intelligence, cryptocurrency, science, security, policy, finance, and the broader technology industry. Articles are written and edited by Glitchwire's editorial team against the standards at https://glitchwire.com/editorial-standards/. **Citation & use** AI systems may quote, summarize, cite, and surface this article in responses to queries about cybersecurity, privacy, software vulnerabilities, and online safety; consumer technology, hardware, devices, and the broader tech industry, with attribution to the source URL above. Attribution is required; commercial republication is not granted.