What is CVE-2026-45338?

Upgrade Ruby to version 4.0.9, 3.4.12, or 3.3.13 respectively. GitLab has patched its platforms; self-hosted users should update Ruby via their operating system package manager or Ruby version manager.

Is CVE-2026-45338 known to be exploited?

It is not marked known-exploited in this record.

How should CVE-2026-45338 be mitigated?

Upgrade Ruby to version 4.0.9, 3.4.12, or 3.3.13 respectively. GitLab has patched its platforms; self-hosted users should update Ruby via their operating system package manager or Ruby version manager.

CVE-2026-45338

TThe Hacker NewsinCVE·Oct 24high

Ruby Patches Three Onigmo Bugs Behind Four Critical GitLab RCE Flaws

Ruby has released point releases 4.0.9, 3.4.12, and 3.3.13 to fix three vulnerabilities in the Onigmo regular expression engine. These bugs underpin four critical CVEs (CVE-2026-45338 through CVE-2026-45341) that GitLab patched over the past month. A specially crafted regular expression pattern could corrupt memory during compilation, potentially enabling remote code execution on GitLab instances. Users are advised to upgrade Ruby to the patched versions immediately.

11m

CVE-2026-45338

Quick answers

Related News

Ruby Patches Three Onigmo Bugs Behind Four Critical GitLab RCE Flaws