Ruby Regexp CVEs: alt-ruby Updates for CloudLinux (CVE-2026-97229 and 3 Others)

📋 TL;DR: last updated 2026-11-05 11:15 UTC

Ruby fixed four memory-corruption bugs in its regular expression engine in versions 4.0.9, 3.4.12, and 3.3.13, published October 23, 2026. The bugs are reached only when an application compiles a regular expression from text an attacker controls. GitLab showed that this can lead to remote code execution on GitLab servers, and a public proof of concept exists for CVE-2026-97229. On October 29, 2026, CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, as exploited against GitLab servers. No exploitation has been reported for the other three CVEs.

• Affected: Ruby 3.3, 3.4, and 4.0 are named by the Ruby advisory, which says nothing about older lines. On CloudLinux, this covers the Ruby Selector alt-ruby packages and ea-ruby27-ruby (cPanel). See Which versions are affected?.
• Mitigation: do not compile regular expressions from untrusted input. Regexp.timeout does not protect, and limiting pattern length does not reliably protect. See Is there a mitigation?.
• Fix status: fixed packages are in the stable repositories for alt-ruby26, 27, 30, 31, 32, 33, 34, 35, and 40 on CloudLinux 7, 8, and 9, for ea-ruby27-ruby on EasyApache 4 (CloudLinux 7 and 8), and for alt-ruby27, 30, 31, 32, 33, 34, 35, and 40 on CloudLinux for Ubuntu 22.04. TuxCare packages are released as well. alt-ruby18 to alt-ruby25 are not supported and receive no fix. CloudLinux does not release alt-ruby packages for Ubuntu 24.04; the TuxCare alt-ruby packages for Ubuntu 24.04 carry the fix. System Ruby 3.3 and 4.0 from the OS package have no fix yet. See Update instructions.
• Verify: compare the installed package release with the table in How to verify. Backported lines keep their Ruby version, so ruby --version does not show whether they are fixed.
• Status page: follow the CloudLinux status page incident for release notices.

Ruby published fixes on October 23, 2026, for four vulnerabilities in the regular expression engine that GitLab reported through its own security releases: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. The CVE IDs were assigned by GitLab. Ruby has not requested IDs for these fixes, so the Ruby advisory refers to GitLab’s CVEs.

Ruby fixed the issues only in 4.0.9, 3.4.12, and 3.3.13. CloudLinux ships Ruby to hosting accounts through Ruby Selector, as alt-ruby packages, so a fix from ruby-lang.org reaches your accounts only when we rebuild those packages and you install them. For lines that upstream no longer maintains, CloudLinux backported the fixes.

Status page.

Release notices for this issue are posted on the CloudLinux status page incident. Subscribe to the status page to be notified of changes.

Why this matters on a shared host

On a shared server, the Ruby version belongs to each account’s application, not to you. An application is exposed only if it builds a regular expression from text that someone else supplies, for example a search or filter feature that treats user input as a pattern. Applications that use only their own fixed patterns are not affected.

You cannot see from the server side which applications do this, so the practical answer is to update the interpreter. The bugs corrupt memory while Ruby compiles the pattern. GitLab showed that this can be turned into remote code execution on GitLab servers.

Which versions are affected?

The Ruby advisory names the 3.3, 3.4, and 4.0 lines. It does not say whether older lines are affected. CloudLinux therefore backported the fixes to the older lines it ships. The table shows where each package stands.

Ubuntu 24.04: CloudLinux does not release alt-ruby packages for Ubuntu 24.04, because CloudLinux packages are released only for Ubuntu 22.04. TuxCare alt-ruby packages for Ubuntu 24.04 are available with the fix for alt-ruby27, 30, 31, 32, 33, 34, 35, and 40, for example alt-ruby33 3.3.13-15, alt-ruby34 3.4.12-14, and alt-ruby40 4.0.9-9.

alt-ruby18 to alt-ruby25 are not supported, and they receive no security fixes, including for these CVEs. CloudLinux supports alt-ruby26 and newer, and TuxCare ELS for Ruby lists versions 2.6 to 4.0. If you run applications on alt-ruby19 to alt-ruby25, move them to a supported alt-ruby version from the table above.

System Ruby is the interpreter that comes with the operating system, not a Ruby Selector package. CloudLinux does not build it. TuxCare Extended Lifecycle Support (ELS) has released fixed builds of the native Ruby for CentOS 7, RHEL 7, Oracle Linux 7, CloudLinux 7 ELS, Amazon Linux 2, AlmaLinux 9.2 ESU, TuxCare 9.6 ESU, TuxCare 9.8 ESU, Alpine 3.18, Ubuntu 16.04, 18.04, and 20.04, and Debian 10 and 11.

Is there a mitigation?

Yes, with limits. If you cannot update yet, avoid compiling regular expressions from untrusted input. In Ruby that means Regexp.new, Regexp.compile, Regexp.union, and interpolation such as /#{input}/ whenever the input comes from a user, a request, or any other source you do not control.

Two common defenses do not help. Regexp.timeout does not protect, because the bugs occur during compilation and not while matching. Limiting the pattern length does not reliably protect either.

This reduces exposure and does not remove it. The fix is the updated package.

Update instructions

Fixed packages are in the stable repositories, so no testing-channel step is needed.

Update: 2026-11-05 11:15 UTC.

On October 29, 2026, CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, which lists flaws that are being exploited in real attacks. The listing names GitLab Community Edition and Enterprise Edition, and CISA notes that other products using the same Ruby regular expression code can be affected. If you have not updated the alt-ruby and ea-ruby27-ruby packages yet, update them now and restart your Ruby applications.

Update: 2026-10-26 12:59 UTC.

Fixed packages are now also released for TuxCare customers. The alt-ruby packages are available at repo.alt.tuxcare.com, and the native Ruby package is fixed under TuxCare ELS and ESU on the systems listed above. The current alt-ruby27 build for CloudLinux 7, 8, and 9 is 2.7.8-152, which includes the fix from 2.7.8-151. Restart Ruby applications after updating.

Update: 2026-10-24 03:30 UTC.

Fixed packages are available in the stable repositories:

• CloudLinux 7, 8, and 9: alt-ruby26 2.6.10-20, alt-ruby27 2.7.8-151, alt-ruby30 3.0.7-175, alt-ruby31 3.1.7-15, alt-ruby32 3.2.11-16, alt-ruby33 3.3.13-14, alt-ruby34 3.4.12-13, alt-ruby35 3.5.0-0.6.preview1, and alt-ruby40 4.0.9-8.
• CloudLinux for Ubuntu 22.04: alt-ruby27 2.7.8-11, alt-ruby30 3.0.7-177, alt-ruby31 3.1.7-15, alt-ruby32 3.2.11-16, alt-ruby33 3.3.13-15, alt-ruby34 3.4.12-14, alt-ruby35 3.5.0~preview1-7, and alt-ruby40 4.0.9-9.
• EasyApache 4: ea-ruby27-ruby 2.7.8-6.el7.cloudlinux.1 (CloudLinux 7) and 2.7.8-6.el8.cloudlinux.1 (CloudLinux 8).

On CloudLinux 7, 8, and 9 (including EasyApache 4):

# See which Ruby packages are installed
rpm -qa 'alt-ruby*' 'ea-ruby27-ruby'

# Update them
yum update 'alt-ruby*' 'ea-ruby27*'

On CloudLinux for Ubuntu 22.04:

dpkg-query -W 'alt-ruby*'

apt-get update
apt-get install --only-upgrade 'alt-ruby*'

Running applications keep using the old interpreter until they restart. After updating, restart the Ruby applications on each account. To restart one application, run the command below. It takes effect after about 10 seconds.

selectorctl --interpreter=ruby --user=USER --restart-webapp APP_DIR

That command works at the application level. To cover the whole server, restart Apache instead. This takes effect server-wide.

apachectl -k graceful
# or, on cPanel:
/scripts/restartsrv_httpd

CageFS needs no extra step for the alt-ruby and ea-ruby27-ruby packages. For system Ruby, run cagefsctl --force-update.

How to verify you are patched

Check the installed package release against the minimum fixed release in the table.

# CloudLinux 7, 8, 9
rpm -q alt-ruby33

# CloudLinux for Ubuntu 22.04
dpkg-query -W alt-ruby33

A package at the listed release or later is fixed. For example, the CloudLinux 8 and 9 repositories already carry alt-ruby27 2.7.8-152, which is newer than the minimum. The package changelog does not name the CVEs for every package. For alt-ruby33, alt-ruby34, and alt-ruby40, the Ruby version is a second check: 3.3.13, 3.4.12, and 4.0.9 or later. For the backported lines the Ruby version stays the same, so use the package release.

The rest of this advisory is background for readers who want it: how the bugs work and how the four CVEs relate. Neither is required to apply the update above.

What the four CVEs are

All four are in Ruby’s regular expression engine (Onigmo). GitLab showed that a specially crafted pattern can corrupt memory while Ruby compiles it, and that this can be turned into remote code execution on GitLab servers, where users can submit their own patterns.

CVE-2026-89078 does not apply to lines older than Ruby 3.3 (alt-ruby26, 27, 30, 31, 32, and ea-ruby27-ruby): the code it fixes was added in Ruby 3.3.

Severity and disclosure

GitLab disclosed the CVEs in its own patch releases between September 23 and October 22, 2026, before Ruby published its fix. A public proof of concept exists for CVE-2026-97229 (Rapid7 reproduced code execution and links a repository). None was found for the other three. On October 29, 2026, CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, as exploited in GitLab Community Edition and Enterprise Edition, and the CISA entry in its CVE record now reads “Exploitation: active”. The CISA entries in the other three CVE records say “Exploitation: none”.

GitLab, as the CNA, rated the CVEs between 9.9 and 10.0 (CVSS 3.1, Critical). Those scores describe GitLab as a product, not Ruby: Ruby’s advisory gives no severity rating. Rapid7 notes that exploiting CVE-2026-97229 on GitLab first requires planting a CI/CD configuration, which the “unauthenticated” rating does not reflect.

Timeline

• 2026-10-29: CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog.
• 2026-10-26 12:59 UTC: fixed packages also released for TuxCare customers (see Update instructions).
• 2026-10-24 03:30 UTC: fixed packages available in the stable repositories (see Update instructions).
• 2026-10-23 18:48 UTC: first status post. Ruby 4.0.9, 3.4.12, and 3.3.13 had been published upstream, and CloudLinux was rebuilding alt-ruby33, alt-ruby34, and alt-ruby40 and backporting the fixes to the older lines. No CloudLinux packages had been released at that time.

References

• Ruby: Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
• Rapid7: CVE-2026-97229, unauthenticated remote code execution in GitLab
• GitLab 19.4.1 patch release and GitLab 19.5.1 patch release
• Ruby branches and end-of-life dates
• CISA Known Exploited Vulnerabilities catalog
• CloudLinux status page incident
• Need help? Contact CloudLinux support