Ruby Onigmo Regex Vulnerabilities Enable GitLab RCE

Ruby has released emergency updates (4.0.9, 3.4.12, and 3.3.13) to address three critical bugs in Onigmo, the language's built-in regular expression engine. These vulnerabilities facilitate four critical Remote Code Execution (RCE) flaws in GitLab, two of which carry a maximum CVSS score of 10.0. The core issue arises when an application compiles a regular expression from a string controlled by an attacker, leading to memory corruption during the compilation phase.

While GitLab is the primary identified target—using these patterns in CI/CD configurations—the risk extends to any Ruby application utilizing `Regexp.new`, `Regexp.union`, or `Regexp.compile` with untrusted input. Notably, Ruby 3.2 and earlier versions have reached End-of-Life (EOL) and will not receive security patches, necessitating an immediate upgrade to supported versions for affected environments.

These flaws are particularly dangerous because typical mitigations like `Regexp.timeout` or pattern length restrictions are ineffective. Organizations using self-managed GitLab instances or custom Ruby applications that process user-supplied regex patterns must prioritize patching to prevent full system compromise.