Hi,
The following vulnerabilities were published for ruby3.3.
CVE-2026-89078[0]:
| GitLab has remediated an issue in GitLab CE/EE affecting all
| versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4
| before 19.4.1 that under certain conditions could have allowed an
| authenticated user to execute arbitrary code on the GitLab server
| due to a double free issue when parsing a specially crafted regular
| expression in a CI/CD configuration.
CVE-2026-93577[1]:
| GitLab has remediated an issue in GitLab CE/EE affecting all
| versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4
| before 19.4.1 that under certain conditions could have allowed an
| authenticated user to execute arbitrary code on the GitLab server
| due to an integer overflow issue when compiling a specially crafted
| regular expression in a CI/CD configuration.
CVE-2026-97229[2]:
| GitLab has remediated an issue in GitLab CE/EE affecting all
| versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4
| before 19.4.2 that, under certain conditions, could have allowed an
| unauthenticated user to execute arbitrary code on the GitLab server
| via a specially crafted regular expression in a CI/CD configuration,
| due to insufficient regular expression validation.
CVE-2026-110264[3]:
| An issue has been discovered in GitLab CE/EE affecting all versions
| from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9,
| 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5
| before 19.5.1 that, under certain conditions, could have allowed an
| unauthenticated user to execute arbitrary code on the GitLab server
| due to integer overflow when compiling a specially crafted regular
| expression.
[4] explaints ot use the same set of CVE in ruby, to track the fixes.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-89078
https://www.cve.org/CVERecord?id=CVE-2026-89078
[1] https://security-tracker.debian.org/tracker/CVE-2026-93577
https://www.cve.org/CVERecord?id=CVE-2026-93577
[2] https://security-tracker.debian.org/tracker/CVE-2026-97229
https://www.cve.org/CVERecord?id=CVE-2026-97229
[3] https://security-tracker.debian.org/tracker/CVE-2026-110264
https://www.cve.org/CVERecord?id=CVE-2026-110264
[4] https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
Regards,
Salvatore