CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Ruby

product · product:ruby single-source

Coverage
1
first 2026-10-22 → last 2026-10-24
Latest activity
2026-10-24
GitLab's critical patch fixes an unauthenticated CVSS 10.0 RCE in Org-mode rendering; no exploitation reported
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
3 hosts

Action items (1)

Do-now tasks recorded on the entries about Ruby, newest first. Check the date before acting on an older one.

  • Upgrade every self-managed GitLab CE and EE instance to 19.5.1, 19.4.3, 19.3.6 or the backport for its line (19.2.9, 19.1.9, 19.0.10, 18.11.13) now, internet-reachable instances and instances with public projects first; builds 19.4.2, 19.3.5 and 19.2.8 are still affected.
    2026-10-22CVE-2026-110264

Defender insights

What each entry about Ruby tells a defender to do, newest first.

2026-10-22NOTABLEGitLab's critical patch fixes an unauthenticated CVSS 10.0 RCE in Org-mode rendering; no exploitation reported

Exposure · triage · detection

Story timeline

  1. 2026-10-22CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)
    trending-vulnerabilitiesGitLab's critical patch fixes an unauthenticated CVSS 10.0 RCE in Org-mode rendering; no exploitation reported

Hunting pivots

CVEs
CVE-2026-110264
Releases covered
Ruby
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-22/cve-2026-110264-gitlab-org-mode-renderer-unauth-rce · ATT&CK page ↗

Entries about Ruby (1)

2026-10-22 · view entry permalink →

NOTABLECVE-2026-110264updatedNATOA2

CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)

GitLab's ad-hoc critical patch release of 2026-10-21 fixes CVE-2026-110264 (CVSS 3.1 10.0), an integer overflow while compiling a specially crafted regular expression that could let an unauthenticated user execute code on the GitLab server (GitLab, 2026-10-21). GitLab's detection write-ups place the flaw in the rendering of Org-mode files: the org-ruby gem builds a regular expression from a custom TODO keyword in a .org file, a keyword with more than 32,767 repeats makes the Onigmo engine write out of bounds when it matches, and with heap grooming that becomes command execution as the git user (GitLab security, 2026-10-21). The attack needs no authentication, only one public project that can hold the .org payload (GitLab security, 2026-10-21). Affected are all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1; GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action (GitLab, 2026-10-21). The builds 19.4.2, 19.3.5 and 19.2.8 from GitLab's earlier regular-expression fixes do not contain this fix (GitLab security, 2026-10-21). GitLab does not state that the flaw is exploited, and its patch notes and detection pages mention no public proof of concept (GitLab, 2026-10-21). The bug is in Ruby's Onigmo regular-expression engine: the Ruby project released 4.0.9, 3.4.12 and 3.3.13 on 2026-10-23 with the fix, the release of 4.0.8 lacks the fix for this flaw, and GitLab fixed its own servers by patching the Ruby it ships (Ruby, 2026-10-23).

Triage: a reader of documentation .org files renders each file once and quickly, while an attack produces a burst of timeouts from one client over a few minutes (GitLab security, 2026-10-21); a worker crash with no accompanying render burst from one client is more likely a benign parser bug than an attack (GitLab security, 2026-10-21).

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1

GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) 2026-10-21

only one public project that can hold the .org payload

GitLab security (detection: Org-mode render error burst) 2026-10-21

a successful CVE-2026-110264 exploit is quiet and does not reliably crash

GitLab security (detection: Onigmo native worker crash) 2026-10-21

These bugs are reached only when an application compiles a regular expression from a string that an attacker controls

Ruby (ruby-lang.org news, Regexp compilation fixes related to GitLab's CVEs) 2026-10-23
Updaterun 2026-10-24T0255Z-intelaffected_productsbodycvesevidencesourcessourcing_notesummaryentities

The Ruby project published an advisory on 2026-10-23 and released Ruby 4.0.9, 3.4.12 and 3.3.13 with fixes for the bugs in its Onigmo regular-expression engine behind four GitLab flaws: CVE-2026-89078 (a double free when parsing a pattern fails after an alternation), CVE-2026-93577 and CVE-2026-97229 (an integer overflow in the size of a compiled pattern) and CVE-2026-110264 (an overflow of internal IDs in a pattern with many repeats) (Ruby, 2026-10-23). Ruby's table gives the first release of each series that carries each fix: the fix for CVE-2026-110264 first appears in 4.0.9, so 4.0.8 is not enough, and 3.4.12 and 3.3.13 carry all of them; GitLab fixed its own servers by patching the Ruby it ships (Ruby, 2026-10-23).

The advisory widens the exposure beyond GitLab to any Ruby application that compiles a regular expression from a string an attacker controls, says Regexp.timeout does not protect against these bugs and that limiting pattern length does not reliably protect, and says Ruby has not requested CVE identifiers of its own and that operators should track the issues under GitLab's identifiers (Ruby, 2026-10-23).

Builds on: GitLab's CVSS 10.0 CI regex flaw now has a public PoC; the demonstrated path needs push access…

vulnerability22 Oct 03:42Zsingle-sourceOpen finding →
Sources: GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) · GitLab security (detection: Org-mode render error burst) · GitLab security (detection: Onigmo native worker crash) · Ruby (ruby-lang.org news, Regexp compilation fixes related to GitLab's CVEs)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • gitlab.com2 (50%)
  • docs.gitlab.com1 (25%)
  • ruby-lang.org1 (25%)
All cited sources (4)