Ruby fixes three critical bugs CVE scanners don’t flag

Ruby 4.0.9, 3.4.12 and 3.3.13 fix three bugs in the Onigmo regex engine, behind four GitLab CVEs rated up to 10.0. The flaws trigger when a pattern is compiled, so any app calling Regexp.new on untrusted input is exposed. Regexp.timeout doesn't help, and the Ruby team says length limits are unreliable. Ruby has issued no CVEs of its own, so scanners may miss old versions; the article says no attacks have been reported, though several details were not independently sourced.