Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.privateaddress? returns false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) corresponding to some private IPv4 addresses, depending on Ruby version, this can include loopback, RFC1918 private networks, and link-local space. An attacker who controls DNS for any domain can publish an AAAA record with such a mapped address; any outbound HTTP fetch Mastodon performs against that hostname then opens a real TCP connection to the underlying IPv4 address, including 127.0.0.1 and cloud-metadata endpoints such as 169.254.169.254. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.
crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x
A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Originally, Common Vulnerabilities and Exposures assigned an identifier of CVE-2011-1005 to the following vulnerability:
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#tos method, as demonstrated by changing an intended pathname.
with the following upstream patch: [1] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?revision=30903&view=revision
Based on later upstream patch for different (CVE-2012-4464 and CVE-2012-4466) issues: [2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
it was found that original upstream 1.8.x ruby patch for CVE-2011-1005 issue was not complete, when the NameError#tos() method was used on / with Ruby objects (the test logic in 'testtostaintnesspropagation' test from [1] was actually reversed, so the test returned success also on still vulnerable instances).
Acknowledgements:
This issue was discovered by Vit Ondruch of Red Hat.
End of life: 3/31/2027, Latest version: 3.3.13
End of life: 3/31/2027, Latest version: 3.3.13
End of life: 3/26/2025, Latest version: 3.1.7
End of life: 3/26/2025, Latest version: 3.1.7
End of life: 3/31/2026, Latest version: 3.2.11
End of life: 3/31/2026, Latest version: 3.2.11
End of life: 3/31/2028, Latest version: 3.4.12
End of life: 3/31/2028, Latest version: 3.4.12
End of life: 3/31/2029, Latest version: 4.0.9
https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/ says: Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
Posted by k0kubun on 23 Oct 2026
We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby.
Background ----------
GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with Regexp.new. GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab servers. GitLab addressed these issues in its own releases by patching the Ruby it ships, and assigned the following CVE identifiers:
CVE-2026-89078: Double Free issue in Regular Expression Parser (GitLab 19.4.1) CVE-2026-93577: Integer Overflow issue in Regular Expression Compiler (GitLab 19.4.1) CVE-2026-97229: Integer Overflow issue in CI/CD Regular Expression Compiler (GitLab 19.4.2) CVE-2026-110264: Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1)
Fixes in Ruby -------------
The following table shows the change in Ruby that fixes the bug behind each CVE, and the first release of each series that contains it.
GitLab CVE Bug in Ruby Change Ruby Ruby Ruby 4.0 3.4 3.3 ---------- ----------- ------- ---- ---- ---- CVE-2026-89078 Double free when parsing a pattern fails after an alternation #13332 4.0.0 3.4.12 3.3.13
CVE-2026-93577, Integer overflow in the size of a CVE-2026-97229 compiled pattern #19020 4.0.8 3.4.12 3.3.13
CVE-2026-110264 Overflow of internal IDs in a pattern with many repeats #16801 4.0.9 3.4.12 3.3.13
Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of these fixes.
Who is affected ---------------
These bugs are reached only when an application compiles a regular expression from a string that an attacker controls, for example by passing it to Regexp.new, Regexp.union or Regexp.compile, or by interpolating it into a regexp literal such as /#{input}/. Applications that only use regular expressions written by their own developers are not affected.
Regexp.timeout does not protect against these bugs. Limiting the length of patterns does not reliably protect against them either, because some of them can be triggered by short patterns.
Recommended action ------------------
We recommend upgrading to Ruby 4.0.9, 3.4.12 or 3.3.13 or later.
If you cannot upgrade, please avoid compiling regular expressions from untrusted input.
Ruby 3.3 is in the security maintenance phase, in which we normally release only fixes for vulnerabilities. Ruby 3.3.13 includes these fixes as an exception, because GitLab assigned CVEs to issues that rely on them.
About CVE identifiers ---------------------
We have not requested CVE identifiers in Ruby for these fixes, at least for now.
Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for CVE-2022-28738, where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for CVE-2024-27282.
However, the Regexp documentation currently discusses untrusted patterns only in terms of denial of service, and recommends a timeout for them. It does not clearly say whether compiling an untrusted pattern is a use case that Ruby supports. We plan to discuss how to document this, and whether we treat this kind of issue as a vulnerability in Ruby, including whether to request CVE identifiers for these fixes. If we request any, we will update this page.
In the meantime, please refer to GitLab’s CVE identifiers listed above when you track these issues, for example in a security scanner.
Credits -------
Thanks to Johan Carlsson (joaxcar) for discovering the integer overflow fixed by #19020 through GitLab’s bug bounty program, and to GitLab for reporting these issues to us and coordinating the fixes.
History --------
Originally published at 2026-10-23 03:11:22 (UTC)
CVE-2026-97229 is an integer overflow in Onigmo, the regex engine built into Ruby, which GitLab uses to compile CI/CD config regexes. A crafted regex can run code on the server without authentication. GitLab scored it 10.0 and says it works "under certain conditions", without saying which.
Fixed in GitLab 19.2.8, 19.3.5 and 19.4.2, released Oct 12. Affected: self-managed CE/EE 19.2.0-19.2.7, 19.3.0-19.3.4, 19.4.0-19.4.1. GitLab.com and Dedicated are already patched.
CISA added it to KEV on Oct 29 with a due date of Nov 1. Rapid7 published a working PoC on Oct 13. Censys counted about 25,766 hosts on affected versions in mid-October.
The catch is in Alpine Linux's post-mortem from Oct 28. Alpine was attacked on Oct 20-21 after it had already upgraded GitLab, and the upgrade did not help. GitLab's patch fixes the Ruby bundled in its own omnibus and CNG packages. Alpine runs GitLab on a system Ruby, so the vulnerable engine was still there. Source installs and distro packages have the same problem.
Those installs need Ruby updated separately: 3.3.13 or 3.4.12 (released Oct 23), or 4.0.8 or later in the 4.0 series. Ruby issued no CVE of its own for this, so scanners report it under the GitLab number.
Check both the GitLab version and the Ruby version before calling an instance patched.
Sources: GitLab critical patch release 19.4.2 / 19.3.5 / 19.2.8 (Oct 12); CISA KEV entry for CVE-2026-97229 (added Oct 29, due Nov 1); Alpine Linux post-mortem (Oct 28); Rapid7 analysis and PoC (Oct 13); Ruby 3.3.13 / 3.4.12 release notes (Oct 23).
It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. (CVE-2018-1000073) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000074) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2018-1000075) It was discovered that Ruby incorrectly handled certain crypto signatures. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000076) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. (CVE-2018-1000077, CVE-2018-1000078, CVE-2018-1000079)