CONNECT WITH US
Cyber Security

Cyber Security

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

The Hacker News logo

Published on

Add as a preferred source on Google
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.

GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.

Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab.

In its advisory, Ruby said an application is affected only if it compiles a regular expression from a string an attacker controls. That happens when a program passes such a string to Regexp.new, Regexp.union or Regexp.compile, or places it inside a pattern through interpolation, as in /#{input}/.

Applications that only use regular expressions written by their own developers are not affected.

Ruby fixed the bugs in 4.0.9, 3.4.12, and 3.3.13. The 3.4.12 and 3.3.13 releases are the first in their series to carry any of the three fixes.

An earlier release from the same week, 4.0.8, does not include the fix for one of the flaws, CVE-2026-110264, so 4.0 users should install 4.0.9.

Ruby 3.2 and earlier will not get a fix. Ruby 3.2 reached end of life on April 1, 2026, and 3.2.11 was its final release. Ruby recommends moving to 3.4 or 4.0.

If you cannot upgrade yet, the advisory says to stop compiling regular expressions from untrusted input.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.