Ruby patches three Onigmo regex bugs behind four critical GitLab RCE flaws

Past-week coverage · Original source published 2026-10-23.

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. According to The Hacker News, those bugs sit behind four critical security flaws that GitLab patched over the past month.

GitLab's finding, as reported, was that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. The report does not name the GitLab flaws, give severity scores, or say which GitLab versions were affected.

Why the regex engine matters

Regular expressions are compiled before they run, and that compile step handles attacker-supplied input in many applications. A memory corruption bug there can be reachable wherever user input reaches a pattern, not only in one product. That is why a language-level fix can close a class of downstream issues at once.

What defenders should do

• Identify Ruby versions in use across application servers, CI runners and build images, and plan upgrades to the fixed releases.
• Treat GitLab's own patches as the direct fix for the four flaws, and apply them where GitLab is deployed.
• Track the upstream Ruby advisory for the technical details rather than relying on secondhand summaries.

The report does not describe exploitation in the wild or say whether the GitLab flaws were exploited. It also does not state which Ruby versions are affected beyond the fixed releases it lists.