Source: ruby3.3 Version: 3.3.8-2 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream
Hi, The following vulnerabilities were published for ruby3.3. CVE-2026-89078[0]: | GitLab has remediated an issue in GitLab CE/EE affecting all | versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 | before 19.4.1 that under certain conditions could have allowed an | authenticated user to execute arbitrary code on the GitLab server | due to a double free issue when parsing a specially crafted regular | expression in a CI/CD configuration. CVE-2026-93577[1]: | GitLab has remediated an issue in GitLab CE/EE affecting all | versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 | before 19.4.1 that under certain conditions could have allowed an | authenticated user to execute arbitrary code on the GitLab server | due to an integer overflow issue when compiling a specially crafted | regular expression in a CI/CD configuration. CVE-2026-97229[2]: | GitLab has remediated an issue in GitLab CE/EE affecting all | versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 | before 19.4.2 that, under certain conditions, could have allowed an | unauthenticated user to execute arbitrary code on the GitLab server | via a specially crafted regular expression in a CI/CD configuration, | due to insufficient regular expression validation. CVE-2026-110264[3]: | An issue has been discovered in GitLab CE/EE affecting all versions | from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, | 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 | before 19.5.1 that, under certain conditions, could have allowed an | unauthenticated user to execute arbitrary code on the GitLab server | due to integer overflow when compiling a specially crafted regular | expression. [4] explaints ot use the same set of CVE in ruby, to track the fixes. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-89078 https://www.cve.org/CVERecord?id=CVE-2026-89078 [1] https://security-tracker.debian.org/tracker/CVE-2026-93577 https://www.cve.org/CVERecord?id=CVE-2026-93577 [2] https://security-tracker.debian.org/tracker/CVE-2026-97229 https://www.cve.org/CVERecord?id=CVE-2026-97229 [3] https://security-tracker.debian.org/tracker/CVE-2026-110264 https://www.cve.org/CVERecord?id=CVE-2026-110264 [4] https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/ Regards, Salvatore
