Ruby’s Regexp Fixes: Check Who Controls the Pattern
For a Ruby application owner, the first question is where a regular-expression pattern comes from. Checking that path helps turn a runtime advisory into a specific maintenance task, rather than a blanket claim that every application has the same exposure.
The October 23 advisory
Ruby’s October 23, 2026 advisory describes Onigmo compilation bugs reached through attacker-controlled patterns, including calls to Regexp.new, Regexp.union and Regexp.compile. It says developer-authored patterns alone are outside this scope, while Regexp.timeout and pattern-length limits are not reliable protections against these bugs. Its recommended fixed releases are Ruby 4.0.9, 3.4.12 or 3.3.13, or later.
Ruby’s advisory: scope, fixes and recommended action
The advisory links the bugs to four GitLab-assigned CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. It distinguishes those identifiers from separate Ruby CVE assignments, which it had not requested when publishing the advisory. Keep the original reference in your tracking record.
Trace the pattern, not just the text being searched
Build a short inventory of features that accept patterns: user-configurable filters, imported rules, administrator forms and configuration consumed by background work. For each candidate, trace the value to its compilation point. Record who can change it, what checks occur, and which service executes that code. Treat this as a review list, not proof that those features in your own application are exploitable.
Keep the pattern and the text being matched in separate columns. A form that accepts text to search is a different code path from a form that accepts the expression itself. Document the actual flow before marking a component affected or unaffected; searching a repository for one method name is a starting point, not a completed exposure assessment.
Match the update to the installed product
The Ruby 4.0.9 release note explicitly links its compilation fix to GitLab’s CVE-2026-110264. Use the release documentation for your maintained runtime series when choosing an update. Record the package or image you actually deploy, along with the evidence for any vendor backport, instead of guessing from a version string alone.
GitLab has its own product patch path. Its October 21 critical release covers CE and EE updates, including 19.5.1, 19.4.3 and 19.3.6, plus backports to older listed branches. That notice says GitLab.com was already patched and warns that upgrades include database migrations. For a self-managed installation, follow the product notice and applicable upgrade instructions; replacing a system Ruby executable is not a substitute for the supported GitLab update.
GitLab’s critical patch notice and upgrade notes
Verify the running service after deployment
Prepare a maintenance record containing the affected feature, owner, deployed build, intended replacement and rollback plan. In staging, exercise normal filters and configuration loading with trusted test inputs. This guide does not require generating an exploit pattern or testing hostile input against a production service.
After the update, confirm which build each application process and worker is running, then check the normal user journey and error reporting. Preserve the deployment result with the original advisory link. If a service cannot be updated immediately, Ruby’s stated interim action is to avoid compiling untrusted patterns; decide how to remove that input path within your application and verify the change.
Close the task with two pieces of evidence: the input path you reviewed and the supported update you deployed. This is an operational review method, not a claim that any particular installation has been compromised or that a scanner result alone proves remediation.
