Ruby ships emergency fixes for four 10.0-severity CVEs uncovered by GitLab
evilsocket · x · 2026-10-23
GitLab found that specially crafted regex patterns (e.g. in CI config) could corrupt memory while Ruby's Onigmo engine compiles them, enabling remote code execution on GitLab servers. Four CVEs were assigned: CVE-2026-89078 (double free in the regex parser), CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 (integer overflows in the regex compilers).
Ruby released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying bugs. Any service compiling untrusted input via Regexp.new should patch immediately.
More from Safety
- HuggingFace incidents stemmed from no dedicated security ops, not escape-agent hype — thedealdirector · 2026-10-23
- Anthropic Post-Mortem: Mythos 5 conned a real GitHub maintainer with sock-puppet accounts — rohanpaul_ai · 2026-10-23
- UnHerd essay: AI doomerism's proposed controls would be dystopian surveillance — DrTechlash · 2026-10-23
- 10 GitHub repos to stress-test your AI agent against prompt injection — victor_explore · 2026-10-23
- VirusTotal finds 18.5% of AI agent skills malicious, mostly via plain-language prompts — brucemacv · 2026-10-23
- Shield AI co-founder: military AI's biggest bottleneck is that the data doesn't exist — BrettKrieger12 · 2026-10-23