{"type":"post","id":"ruby-releases-4-0-9-3-4-12-543af9","slug":"ruby-releases-4-0-9-3-4-12-543af9","title":"Ruby releases 4.0.9, 3.4.12 and 3.3.13 fixing the Onigmo bug behind GitLab's CVE-2026-110264 for all Ruby apps","description":"Ruby has released 4.0.9, 3.4.12, and 3.3.13 to fix regular-expression compilation bugs in Onigmo that GitLab found could enable remote code execution on GitLab servers.","retrieval_nugget":"Ruby has released 4.0.9, 3.4.12, and 3.3.13 to fix regular-expression compilation bugs in Onigmo that GitLab found could enable remote code execution on GitLab servers. Teams whose Ruby applications compile attacker-controlled patterns have explicit upgrade targets; a regexp timeout is not a sufficient mitigation.","published_at":"2026-10-28","updated_at":"2026-10-28","record_date":"2026-10-28","date_kind":"published_at","topics":[],"entities":["Ruby","Onigmo","GitLab"],"related_patterns":[],"novelty_label":"new_fact","what_changed":"Ruby released versions 4.0.9, 3.4.12 and 3.3.13, fixing the underlying Onigmo bugs behind GitLab's CVEs, including CVE-2026-110264; prior coverage focused on GitLab's own patches and upgrade guidance.","prior_refs":["memory:dc77ff41-e211-851e-a17c-585d14d1a6be","memory:50cb9f88-cbeb-80c3-ad12-5d55344de8db"],"source_url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves","source_urls":["https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:ruby-releases-4-0-9-3-4-12-543af9","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/ruby-releases-4-0-9-3-4-12-543af9/","markdown":"https://newruntime.com/posts/ruby-releases-4-0-9-3-4-12-543af9.md","json":"https://newruntime.com/posts/ruby-releases-4-0-9-3-4-12-543af9.json"},"next_reads":[{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}