CVE-2026-89078
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.
- CVSS
- 9.9
- EPSS
- 0.004 (37.2th percentile)
- CISA KEV
- Not listed
- Exploitation
- none
- Public exploits
- None seen
- State
- PUBLISHED
Coverage
Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards
Ruby 3.3.13 Released
Ruby 3.3.13 has been released. This release includes security fixes. Please check the topics below for details. Security advisories: CVE-2026-80212 and CVE-2026-80213 Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release updates…
Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards
Ruby 3.4.12 Released
Ruby 3.4.12 has been released. This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577…
Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards
Ruby 4.0.9 Released
Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation that GitLab’s CVE-2026-110264 relies on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 Please see the…
Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards
Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying…
What we observed
No signals recorded