Affected Systems
Ruby versions 4.0.0–4.0.8, 3.4.0–3.4.11, and 3.3.0–3.3.12. Ruby 3.2 and earlier (EOL) will not receive patches. GitLab versions 7.0+ were affected; patched in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13. Any application compiling regex from attacker-controlled strings (Regexp.new, Regexp.union, Regexp.compile, or interpolation) is vulnerable.
Exploitation Status
Four GitLab CVEs issued (CVE-2026-97229, CVE-2026-110264, two others from Sept 23). All reported via bug bounty by researcher joaxcar. Not listed in CISA KEV as of Oct 23, 2026. No public PoC mentioned, but exploitation path is documented. Ruby has not assigned its own CVEs yet.
Business Impact
Memory corruption during regex compilation can lead to remote code execution. GitLab instances were vulnerable to unauthenticated RCE (CVSS 10.0 for two flaws, 9.9 for two others). Any Ruby application that compiles regex from user input—common in CI/CD pipelines, search features, validation logic—is at risk. Regexp.timeout does not mitigate; pattern length caps are unreliable. Ruby 3.2 and earlier are EOL and unpatched, forcing migration. GitLab.com already patched; self-managed instances require immediate updates. Detection rules available from GitLab.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13 immediately. Do not use 4.0.8, which lacks the fix for CVE-2026-110264.
- Upgrade self-managed GitLab instances to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 (includes bundled patched Ruby).
- Audit all Ruby applications for use of Regexp.new, Regexp.union, Regexp.compile, or regex interpolation with user-supplied input. Eliminate or sanitize untrusted regex compilation.
- Deploy GitLab's published detection rules on self-managed instances to identify exploitation attempts in logs.
- Plan migration from Ruby 3.2 and earlier (EOL, no patch available) to 3.4 or 4.0 within 30 days.