Ruby's core team announced three releases on October 23: 4.0.9, 3.4.12 and 3.3.13. They repair flaws in Onigmo, the engine behind Ruby's regular expressions, which are text-matching patterns. GitLab found that crafted patterns could damage memory as Ruby builds them, letting attackers run code on GitLab servers. GitLab issued four CVEs, which are public vulnerability IDs. The Hacker News reported that two need a logged-in account and scored 9.9 out of 10, and two need none and scored 10.0.
Ruby said only apps that build patterns from attacker-controlled text are exposed. It said timeouts do not help and length limits are unreliable. So far Ruby has requested no CVEs of its own, and it plans to discuss whether to. Its documentation names only one danger from untrusted patterns: denial of service, meaning a service knocked offline. The Hacker News reported that GitLab's records name only GitLab, and that Ruby 3.2 and earlier get no fix. On October 23, it found none of the four in CISA's catalog of exploited flaws.
Scanners that match CVEs to Ruby versions may miss this, so a clean report may not mean the Ruby is patched. Leaders can ask which apps build patterns from user input, and whether anything runs Ruby 3.2 or earlier.