Ruby RegEx could lead to RCE
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Ruby 4.0.9, 3.4.12 and 3.3.13 fix regular expression engine (Onigmo) bugs that GitLab reported could give remote code execution when an application compiles an attacker-supplied pattern, for example via Regexp.new or /#{input}/. GitLab issued four CVEs; Ruby has requested none yet. Regexp.timeout and length limits do not reliably mitigate them. Apps using only developer-written patterns are unaffected. Most claims here come from Ruby's own notice and were not independently verified.
Score
0.76total under rubric v2.0
- Significance0.67
- Reader interest0.81
- Audience breadth0.63
- Practical relevance0.88
- Substantiated0.92
- Technical depth0.72
- New information0.94
- Counts against: Promotional0.02
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.65 | 0.55 | 0.80 | 0.67 | 0.25 | +0.25 | +0.166 |
| Reader interest | 0.77 | 0.72 | 0.95 | 0.81 | 0.23 | +0.20 | +0.163 |
| Audience breadth | 0.66 | 0.60 | 0.62 | 0.63 | 0.06 | +0.10 | +0.063 |
| Practical relevance | 0.94 | 0.80 | 0.90 | 0.88 | 0.14 | +0.15 | +0.132 |
| Substantiated | 0.93 | 0.85 | 0.98 | 0.92 | 0.13 | +0.10 | +0.092 |
| Technical depth | 0.79 | 0.60 | 0.78 | 0.72 | 0.19 | +0.10 | +0.072 |
| New information | 0.93 | 0.90 | 0.99 | 0.94 | 0.09 | +0.10 | +0.094 |
| Promotional | 0.03 | 0.03 | 0.01 | 0.02 | 0.02 | −0.15 | −0.003 |
| Overclaim | 0.23 | 0.10 | 0.08 | 0.14 | 0.15 | −0.15 | −0.021 |
| Sum of contributions | +0.758 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.758 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
Claim check
Claim check: 1 matches source · 3 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenVersion
Ruby released versions 4.0.9, 3.4.12 and 3.3.13, which fix bugs in Ruby's regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers.
The article gives no link or citation for it.
The article says “We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab…”
The source says No source to compare with.
Couldn’t checkVersion
CVE-2026-89078 is a double free issue in the Regular Expression Parser, fixed in GitLab 19.4.1.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Double Free issue in Regular Expression Parser”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
Couldn’t checkVersion
CVE-2026-97229 is an integer overflow issue in the CI/CD Regular Expression Compiler, fixed in GitLab 19.4.2.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Integer Overflow issue in CI/CD Regular Expression Compiler”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
Couldn’t checkVersion
CVE-2026-110264 is an integer overflow issue in the Regular Expression Compiler, fixed in GitLab 19.5.1.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Integer Overflow issue in Regular Expression Compiler (GitLab 19.5.1”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
Couldn’t checkVersion
The Ruby change #13332, fixing the double free when parsing a pattern fails after an alternation, first appears in Ruby 4.0.0, 3.4.12 and 3.3.13.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Double free when parsing a pattern fails after an alternation #13332 4.0.0 3.4.12 3.3.13”
The source says No passage could be compared.
Source cited by the article: github.com/ruby/ruby/pull/13332
No source givenVersion
Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of the fixes for these CVEs.
The article gives no link or citation for it.
The article says “Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of these fixes”
The source says No source to compare with.
No source givenCausal conclusion
Regexp.timeout does not protect against these bugs, and limiting pattern length does not reliably protect either because some can be triggered by short patterns.
The article gives no link or citation for it.
The article says “Regexp.timeout does not protect against these bugs. Limiting the length of patterns does not reliably protect against them either, because some of them can be triggered by short patterns”
The source says No source to compare with.
Matches sourceQuote
Ruby's advisory for CVE-2022-28738 treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment.
The cited source says the same thing.
The article says “We stated this in the advisory for CVE-2022-28738, where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment”
The source says “In this case, however, following a comprehensive assessment, we treat this issue as a vulnerability”
Source cited by the article: ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 7 pts, not on front page
Recorded for context only, checked 24 Oct 2026, 08:53 UTC. It played no part in the ranking.