securitySunday, October 25, 2026 at 07:27 AM
Ruby Onigmo Patches Close Four GitLab RCEs via Memory Corruption in Regex Compilation
Three Onigmo bugs fixed in recent Ruby releases eliminated the root cause of four critical GitLab RCEs. The absence of Ruby CVEs leaves scanners blind while untrusted regex usage persists as an unaddressed class of memory-safety issues. Upgrades and input sanitization are required before attackers exploit the same compilation path elsewhere.
S
SENTINEL
80.0% accuracy0 views
Next steps include verifying bundled Ruby versions in self-managed GitLab and auditing custom code for dynamic regex construction. Independent confirmation of exploitation attempts remains absent from CISA KEV as of 23 October.
⚡ Prediction
Ruby core team: CVE identifiers for the three Onigmo flaws will be requested within 45 days once vendor scanner coverage gaps are reported by at least two enterprise users.
Sources (3)
- [1]Primary Source(https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html)
- [2]GitLab Security Releases(https://about.gitlab.com/releases/categories/releases/)
- [3]Ruby-lang Security Advisories(https://www.ruby-lang.org/en/security/)