Ruby versions 4.0.9, 3.4.12, and 3.3.13 address three memory corruption bugs in the Onigmo regular expression engine.

Developers handling untrusted input in regex patterns should review the updates.

Which programs are affected?

According to the official update, the problem is not limited to GitLab. Any application that reads text from an external source and converts it into a text search rule is at risk, as attackers could exploit this process to execute code on the systems hosting the application. In contrast, programs that use exclusively rules written by their creators are not affected.

Older versions 3.2 and below will not receive any updates, as their support ended in April 2026. At the same time, it was emphasized that measures such as limiting execution time or limiting text length cannot prevent this specific problem.

How the problems were revealed

GitLab published four security reports between September 23 and October 21, each patched with the inclusion of patched versions of Ruby.…