Ruby

GitLab Critical Vulnerabilities Traced to Ruby Onigmo Regex Engine Flaws

GitLab has disclosed multiple critical vulnerabilities, including CVE-2026-97229 with a CVSS score of 10.0, that stem directly from underlying defects in the Ruby programming language's Onigmo regular expression engine. The issues affect CI/CD configuration processing and were confirmed exploited in the wild after GitLab released patches on October 8, 2026. Ruby's development team followed with its own advisory on October 23, 2026, confirming that four separate CVEs share the same root cause in Onigmo. The affected flaws include integer overflows during regex compilation and parsing as well as a double-free memory corruption condition. Because the vulnerabilities reside in a core dependency, any Ruby environment using similar regex patterns may also be exposed. Organizations running GitLab are urged to apply the updated versions 19.4.2, 19.3.5, and 19.2.8 immediately.