Ruby fixes three critical bugs CVE scanners don’t flag
Comments on “Ruby fixes three critical bugs CVE scanners don’t flag”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Ruby 4.0.9, 3.4.12 and 3.3.13 fix three bugs in the Onigmo regex engine, behind four GitLab CVEs rated up to 10.0. The flaws trigger when a pattern is compiled, so any app calling Regexp.new on untrusted input is exposed. Regexp.timeout doesn't help, and the Ruby team says length limits are unreliable. Ruby has issued no CVEs of its own, so scanners may miss old versions; the article says no attacks have been reported, though several details were not independently sourced.
Why it ranked
No. 17 of 111 with a score of 0.73. The panel rated it highest on practical relevance (0.89) and technical depth (0.82), lowest on audience breadth (0.62). The judges disagreed most on new information (spread 0.42), so the story is marked contested. Placed No. 17, No. 9 by score alone: the eighth Security story of the day (−0.080), and close to “GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux”, No. 3 on Thursday 29 October 2026 (−0.007). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Security fixes in Ruby's regex engine with concrete CVE details, GitLab impact, and mitigation guidance; highly practical for builders, though the bugs are in a niche path of untrusted-pattern compilation.
- AI judgeJudge 3gpt-5.6-luna
- A well-supported, actionable security report explaining Ruby regex compilation flaws, affected usage patterns, exploitation impact, mitigations, upgrade paths, and why ordinary CVE scanners may miss vulnerable installations.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.73total under rubric v2.3Contestedjudges differ by 0.42 on new information
- Significance0.66
- Reader interest0.79
- Audience breadth0.62
- Practical relevance0.89
- Substantiated0.73
- Technical depth0.82
- New information0.78
- Counts against: Promotional0.03
- Counts against: Overclaim0.22
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.70 | 0.55 | 0.72 | 0.66 | 0.17 | +0.24 | +0.158 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.78 | 0.70 | 0.90 | 0.79 | 0.20 | +0.26 | +0.206 |
| Audience breadthHow many people who build technology does it concern? | 0.65 | 0.60 | 0.62 | 0.62 | 0.05 | +0.13 | +0.081 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.94 | 0.85 | 0.88 | 0.89 | 0.09 | +0.22 | +0.196 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.60 | 0.80 | 0.78 | 0.73 | 0.20 | +0.05 | +0.036 |
| Technical depthHow technically substantive is it? | 0.91 | 0.80 | 0.76 | 0.82 | 0.15 | +0.05 | +0.041 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.81 | 0.55 | 0.97 | 0.78 | 0.42 , above the contested threshold | +0.05 | +0.039 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.03 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.44 | 0.10 | 0.12 | 0.22 | 0.34 | −0.11 | −0.024 |
| Sum of contributions | +0.728 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.728 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/17/"><img src="https://rubric.hrih.si/badge/2026-10-31/17.svg" alt="Ranked #17 on Rubric, 31 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 3 matches source · 4 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceVersion
The Ruby team released versions 4.0.9, 3.4.12, and 3.3.13, fixing three bugs in the Onigmo regex engine that can lead to malicious code running on affected servers.
The cited source says the same thing.
The article says “The Ruby team has released versions 4.0.9, 3.4.12, and 3.3.13. They fix three bugs in the Onigmo regex engine”
The source says “We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab…”
Source cited by the article: ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves
No source givenNumber
Four GitLab vulnerabilities reported by Johan Carlsson carry CVSS scores of 9.9 (two) and 10.0 (two), the latter exploitable without authentication.
The article gives no link or citation for it.
The article says “CVE-2026-89078 and CVE-2026-93577, each with a CVSS score of 9.9, and CVE-2026-97229 and CVE-2026-110264, both with the maximum score of 10.0 and exploitable without authentication”
The source says No source to compare with.
No source givenDate
GitLab fixed the four CVEs between Sept. 23 and Oct. 21 by patching the Ruby it bundles, and the latest update affects all GitLab versions back to 7.0 in 2014.
The article gives no link or citation for it.
The article says “GitLab fixed them between Sept. 23 and Oct. 21 by patching the Ruby it bundles”
The source says No source to compare with.
Matches sourceCausal conclusion
The Ruby team traces the four CVEs to three bugs: a double-free during pattern reading, an integer overflow in compiled program size calculation (two CVEs), and an overflow of internal counters in patterns with very many repetitions.
The cited source says the same thing.
The article says “The Ruby team traces the four CVEs to three bugs: CVE-2026-89078 involves a double-free when a pattern is read”
The source says “CVE-2026-93577, CVE-2026-97229 | Integer overflow in the size of a compiled pattern | #19020 | 4.0.8 | 3.4.12 | 3.3.13”
Source cited by the article: ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves
Couldn’t checkDate
Ruby 4.0.8, released Oct. 22, included the program-size fix as part of a routine update without mentioning security, and 4.0.9 followed a day later with the last missing fix.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Ruby 4.0.8, released Oct. 22, included the program-size fix as part of a routine update without mentioning security”
The source says No passage could be compared.
Source cited by the article: ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves
Matches sourceCausal conclusion
Regexp.timeout does not protect against these bugs because they occur during pattern compilation, and limiting pattern length is not reliable because short patterns can trigger some bugs.
The cited source says the same thing.
The article says “But Regexp.timeout only stops a match that takes too long. The bugs occur earlier, during compilation, so the timeout doesn’t help”
The source says “Regexp.timeout does not protect against these bugs. Limiting the length of patterns does not reliably protect against them either, because some of them can be triggered by short patterns”
Source cited by the article: ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves
No source givenNumber
Neither GitLab nor Ruby has reported active attacks so far.
The article gives no link or citation for it.
The article says “Neither GitLab nor Ruby has reported active attacks so far”
The source says No source to compare with.
No source givenCausal conclusion
Because the CVEs identify GitLab versions rather than Ruby versions, CVE-database scanners will not flag an old Ruby 3.4.11 installation.
The article gives no link or citation for it.
The article says “Tools that check installed software against CVE databases therefore won’t find an entry for an old Ruby 3.4.11 installation and won’t flag it”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.