Ruby Onigmo regexp compilation bugs (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264): is my Ruby app affected outside GitLab, and which Ruby versions fix it?

Am I affected? These four CVEs were found through GitLab, but the bugs are in Ruby's own regular expression engine (Onigmo). They're a double free in the pattern parser, two integer overflows in compiled patterns, and an internal ID overflow with many repeats. Any Ruby app can be hit if it compiles regular expressions from untrusted input, and that can lead to code execution. Affected: - Ruby 3.3 before 3.3.13 - Ruby 3.4 before 3.4.12 - Ruby 4.0 before 4.0.9 You're exposed if user-controlled text reaches Regexp.new, Regexp.union or interpolation into a regexp literal (/#{input}/), e.g. search filters, user-defined rules, routing or validation patterns stored in a database, or rendering features that build patterns from content. Apps that only use regexps their own developers wrote are not affected. How to check: - ruby -v in every environment (and inside container images: docker run --rm <image> ruby -v). - Search the code for dynamic patterns: grep -rnE 'Regexp\.(new|union|compile)|/#\{' app lib. Fix: - Upgrade to Ruby 4.0.9, 3.4.12 or 3.3.13 or later (rbenv/asdf/rvm install, or a new ruby:* base image), rebuild, and restart all processes. - GitLab self-managed: upgrade GitLab itself (it ships its own Ruby); see GitLab's patch release notes. Interim mitigation (until upgraded): - Stop compiling regexps from untrusted input: use Regexp.escape on user text so it matches literally, or use plain string methods (include?, start_with?) instead. - Regexp.timeout does NOT protect against these bugs, and limiting pattern length isn't reliable either, since some trigger with short patterns. After upgrading: - Confirm ruby -v from inside the running app (e.g. a console or health check prints RUBY_VERSION), not just on the build machine. - Check for crashes (segfaults in regexp compilation) in logs from before the upgrade, since they can be a sign of probing. Sources: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/ https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/ https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-october-cff https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/