Ruby 4.0.9, 3.4.12 and 3.3.13 fix Onigmo regex RCE flaws
The security releases address double free and integer overflow issues in the Onigmo regular expression engine that GitLab reported as potentially exploitable.
The Ruby development team released security updates on 23 October 2026 (UTC) fixing multiple issues in the Onigmo regular expression engine used by Ruby. The fixed versions are Ruby 4.0.9, Ruby 3.4.12 and Ruby 3.3.13, according to forest.watch.impress.co.jp.
The issues include a double free in the regex parser and integer overflows in the regex compiler, including the CI/CD regex compiler. Crafted regex patterns can corrupt memory when Ruby compiles them, potentially enabling remote code execution. GitLab reported the issues as potentially exploitable for remote code execution on GitLab servers, and four CVE numbers were assigned: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264.
Affected applications are those that compile regular expressions from attacker-controlled strings, such as through Regexp.new, Regexp.union, Regexp.compile, or patterns interpolated into regex literals. Applications that use only developer-written regular expressions are not affected.
No reliable workaround, team says
The Ruby team stated that timeouts and pattern length limits are not reliable mitigations. Users who cannot update immediately should avoid compiling regular expressions from untrusted input. In Ruby 3.3.13 the bundled resolv library was also updated to v0.3.2.
Ruby said it has not decided whether to treat these as vulnerabilities itself and has not applied for CVE numbers, so tracking should use the GitLab-issued numbers for now. GitLab had already patched the bundled Ruby in GitLab v19.4.1, v19.4.2 and v19.5.1, and the fixes have now been incorporated into Ruby's release branches.
Quick answers
Which Ruby versions fix the Onigmo issues?
Ruby 4.0.9, Ruby 3.4.12 and Ruby 3.3.13, released on 23 October 2026 (UTC).
Is my Ruby application affected?
Only applications that compile regular expressions from attacker-controlled strings, for example via Regexp.new or Regexp.union, are affected. Applications using only developer-written patterns are not.
Are timeouts or pattern length limits enough to protect against these flaws?
No. The Ruby team says timeouts and pattern length limits are not reliable mitigations; users who cannot update should avoid compiling regexes from untrusted input.