Runtime securitySat, 24 Oct 2026
Ruby Onigmo memory corruption: update runtimes and review dynamic regex inputs
Ruby released 4.0.9, 3.4.12 and 3.3.13 on October 23, 2026. All three releases fix four Onigmo regular expression compilation defects. Memory corruption may occur when an application compiles an attacker-controlled pattern. Check search, filtering and user-defined rules first.
Article
Ruby released 4.0.9, 3.4.12 and 3.3.13 on October 23, 2026. All three releases fix four Onigmo regular expression compilation defects. Memory corruption may occur when an application compiles an attacker-controlled pattern. Check search, filtering and user-defined rules first.
- 01
Accept an external pattern
- 02
Compile it using vulnerable Onigmo
- 03
Memory corruption may affect the process
- CVE-2026-89078: double free after a pattern fails to parse. Fixed in Ruby 4.0.0 on the 4.0 branch.
- CVE-2026-93577 and CVE-2026-97229: integer overflows while calculating compiled pattern size. Fixed in 4.0.8 on the 4.0 branch.
- CVE-2026-110264: a large number of repeated items can overflow internal identifiers. Fixed in 4.0.9 on the 4.0 branch. All four fixes are in 3.4.12 and 3.3.13 on their respective branches.
- If you cannot update immediately, stop compiling untrusted patterns. Regexp.timeout and pattern length limits alone do not reliably prevent these defects.
- 01
Inventory every Ruby runtime
Cover public and internal services, managed applications, container images, CI and embedded runtimes.
See what to doResources: 1
TWISA member solutions
Inventory every Ruby runtime
Cover public and internal services, managed applications, container images, CI and embedded runtimes.
- 02
Find attacker-controlled input paths
Find features that turn outside input into Regexp patterns, especially search, filtering and rules.
- 03
Update and rebuild deployments
Apply the vendor’s fix for each branch, rebuild images and confirm the running version.
- 04
Retest in an authorized environment
Test input handling, errors and process stability. Review logs and retain the update record.
See what to doResources: 2
TWISA member solutions
Retest in an authorized environment
Test input handling, errors and process stability. Review logs and retain the update record.
Allow authorized traffic and apply controls at each layer.
- 01
Inventory every Ruby runtime
Cover public and internal services, managed applications, container images, CI and embedded runtimes.
- 02
Find attacker-controlled input paths
Find features that turn outside input into Regexp patterns, especially search, filtering and rules.
- 03
Update and rebuild deployments
Apply the vendor’s fix for each branch, rebuild images and confirm the running version.
Feed logs and traffic data from each layer into monitoring and response.
- Retest in an authorized environmentTest input handling, errors and process stability. Review logs and retain the update record.
TWISA member solutions
Inventory every Ruby runtime → Runtime inventory and vulnerability tracking
Record deployed Ruby versions and track remediations.
Retest in an authorized environment → External input and application testing
Test the path from external input to compilation and confirm the fix.
Retest in an authorized environment → Application logs and process events
Correlate compiler errors and unexpected process behavior.
Find attacker-controlled input paths → Restrict external pattern input
Prefer fixed patterns and validate input before compilation. If applicable, check the published SkyCloud offer and test edge rules before relying on them.
Find attacker-controlled input paths → Limit the Ruby service’s database access
Limit service accounts to the databases, tables and actions they need.
Find attacker-controlled input paths → Encrypt and mask sensitive fields
Reduce plaintext exposure with field-level encryption and masking.
Sources and further reading
Alert updated: 2026/10/25. Check vendor guidance for the latest support and patch status.