Search — “CVE-2026-110264”

Ruby released 4.0.9, 3.4.12 and 3.3.13 to fix three Onigmo regex engine bugs that GitLab's four critical CVEs (CVE-2026-97229, CVE-2026-110264 and two earlier logged-in flaws) rely on. Per the sources, the bugs can corrupt memory while Ruby compiles a crafted pattern, and any Ruby application that compiles regexes from attacker-controlled strings via Regexp.new, Regexp.union, Regexp.compile or interpolation is affected. The sources do not confirm exploitation; none of the four CVEs was in CISA KEV as of October 23, 2026. Hunt for patterns in GitLab CI/CD or app inputs that reach regex compilation, and upgrade self-managed GitLab to a fixed release.

GitLab fixed CVE-2026-110264, an integer overflow during compilation of a crafted regular expression in the bundled Onigmo engine, allowing unauthenticated remote code execution on self-managed servers. The flaw reaches every release since 7.0 (2014), and GitLab has not disclosed the preconditions or offered a workaround. No exploitation or KEV listing was reported as of October 22; hunters should check for the published Sigma detections 'Onigmo native worker crash' and 'Org mode render error burst' against GitLab application logs.