https://seclists.org/oss-sec/2026/q4/360: Ruby gexp compilation fixes lated to GitLab's CVE's

Q: Which deployments are realistically exposed to these bugs?

Applications that compile regular expressions supplied by users are exposed, particularly where untrusted patterns are passed to Ruby's Regexp.new. GitLab is specifically identified because it compiles user-provided patterns such as those in CI configuration.

Q: What does an attacker need to do to exploit the issue?

An attacker needs a way to supply a specially crafted regular-expression pattern that the target application will compile. The reported issue occurs during regular-expression compilation and can corrupt memory, which GitLab determined could be turned into remote code execution on its servers.

Q: What versions contain the Ruby fixes?

Ruby 4.0.9, 3.4.12, and 3.3.13 contain fixes for the underlying regular-expression engine bugs. GitLab also addressed the issues in its own releases by patching the Ruby version it ships.

Published Oct 23, 2026

Updated

Affected Software

1 affected component

Ruby Ruby<4.0.9, <3.4.12, <3.3.13

Frequently Asked Questions

Which deployments are realistically exposed to these bugs?

Applications that compile regular expressions supplied by users are exposed, particularly where untrusted patterns are passed to Ruby's Regexp.new. GitLab is specifically identified because it compiles user-provided patterns such as those in CI configuration.

What does an attacker need to do to exploit the issue?

An attacker needs a way to supply a specially crafted regular-expression pattern that the target application will compile. The reported issue occurs during regular-expression compilation and can corrupt memory, which GitLab determined could be turned into remote code execution on its servers.

What versions contain the Ruby fixes?

Ruby 4.0.9, 3.4.12, and 3.3.13 contain fixes for the underlying regular-expression engine bugs. GitLab also addressed the issues in its own releases by patching the Ruby version it ships.