Ruby Patches Three Onigmo Bugs Behind Four Critical GitLab RCE Flaws

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.

GitLab discovered that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers.

The four CVEs assigned are CVE-2026-45338, CVE-2026-45339, CVE-2026-45340, and CVE-2026-45341. All four stem from the same class of Onigmo memory-corruption bugs but manifest as distinct security flaws in GitLab's deployment.

Ruby's advisory states that the issues affect the Onigmo regex engine component. GitLab has already applied patches to its platforms. Users running affected Ruby versions should upgrade via their package manager to the released point releases.

There is no confirmed public exploit code at the time of reporting, but the memory-corruption vector during regex compilation presents a credible RCE risk, particularly for self-hosted GitLab instances processing untrusted input.