Ruby: regex engine flaws (CVE-2026-110264, CVE-2026-97229) fixed in 4.0.9, 3.4.12 and 3.3.13
CVE-2025-24294 CVE-2025-58767 CVE-2026-110264 CVE-2026-41316 CVE-2026-42245 CVE-2026-42246 CVE-2026-42256 CVE-2026-42257 CVE-2026-42258 CVE-2026-47240 CVE-2026-47241 CVE-2026-47242 CVE-2026-93577 CVE-2026-97229
Published 09/11/2026 19:30
Timeline
2 events over 11 d
- 29/10/2026 13:54ConfirmedBSI CERT-Bund (WID)+11 d
- 09/11/2026 19:30Published on WatchtowerPro CISO
In short
Ruby's own advisory lists four regex-compiler flaws that can lead to remote code execution when an application compiles a regex from attacker-controlled text. Ruby 4.0.9, 3.4.12 and 3.3.13 contain all the fixes. A public proof-of-concept exists for CVE-2026-110264. Ruby's advisory names GitLab as the demonstrated target, and GitLab shipped its own fixed releases. GreyNoise reports a public exploit for CVE-2026-110264 (11/11/2026).
How bad is it
Critical. An attacker who can feed text into an application that builds regular expressions from it may be able to run their own code on the server, without logging in.
Being exploited - on CISA's known-exploited list since 29/10/2026.
Severity score
The worst of 14 CVEs · CVSS 3.1 from NVD, from gitlab.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Applications that compile a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile, or interpolation such as /#{input}/). Ruby says applications that only use regexes written by their own developers are not affected.
- Ruby 4.0, 3.4 and 3.3 before the fixed releases are named in Ruby's advisory. CVE-2026-89078 is first fixed in 4.0.0, CVE-2026-93577 and CVE-2026-97229 in 4.0.8, CVE-2026-110264 in 4.0.9; all four in 3.4.12 and 3.3.13.
- GitLab compiles user-supplied patterns, for example in CI configuration, and Ruby describes it as the demonstrated remote-code-execution target.
Fixed in
- 4.0 branch: 4.0.9 (released 23/10/2026)
- 3.4 branch: 3.4.12 (released 23/10/2026)
- 3.3 branch: 3.3.13 (released 23/10/2026)
What to do now
- Upgrade Ruby to 4.0.9, 3.4.12 or 3.3.13 (or later), all released 23/10/2026.
- For distribution Ruby packages, check your distribution's tracker for a backported fix.
- If you run GitLab, update GitLab itself: 19.4.1 (CVE-2026-89078, CVE-2026-93577), 19.4.2 (CVE-2026-97229) and 19.5.1 (CVE-2026-110264). Upgrading system Ruby does not change the Ruby GitLab ships.
- Until updated, do not compile regexes from untrusted input; do not rely on Regexp.timeout or length limits. These interim measures reduce exposure and do not make a server safe.
- Ask Ruby or your distribution about Ruby 3.2 and older, which the advisory does not mention.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 3 open questions, followed up as sources answer and all 12 sources with their dates. And technology matching: which of your systems run Ruby, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [mittel] Ruby: Schwachstelle ermöglicht Denial of Service CERT · [UPDATE] [mittel] Ruby: Schwachstelle ermöglicht Offenlegung von Informationen CERT · [UPDATE] [mittel] Ruby: Schwachstelle ermöglicht Denial of Service CERT