diff --git a/_data/downloads.yml b/_data/downloads.yml index cc7a534263..6164ba7a79 100644 --- a/_data/downloads.yml +++ b/_data/downloads.yml @@ -8,7 +8,7 @@ preview: stable: - - 4.0.8 + - 4.0.9 - 3.4.11 # optional diff --git a/_data/releases.yml b/_data/releases.yml index 9d491df57c..571a68b69d 100644 --- a/_data/releases.yml +++ b/_data/releases.yml @@ -52,6 +52,30 @@ # 4.0 series +- version: 4.0.9 + date: 2026-10-23 + post: /en/news/2026/10/23/ruby-4-0-9-released/ + url: + gz: https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.tar.gz + zip: https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.zip + xz: https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.tar.xz + size: + gz: 23946524 + zip: 29263242 + xz: 17996144 + sha1: + gz: 39f31360bc0c03bde9eec4177e443f6298481e2e + zip: 9e2d496d0f3663918c3183b8671c7f4b78aa185e + xz: 630cf1e7a4c522f49a2fec383805627691500b54 + sha256: + gz: c35350682ff050b79702d57ade4516e7336063f510155d19fb2fb5b3f3909511 + zip: 8242fbb2354cb71811cb2ff4d5e149b7a0ecb700e6c61a897710204ac36f866b + xz: a8057adb39f51ad6dc3106237504c93dd792bb515837b4fe7817ae21ed7e51f4 + sha512: + gz: 9adb0069a07ee1348a04b627d8af1c9f2b6537bdea5dce0b57423659626d9ae3cc04955eae7167014c56bd0f4c7c9d1aa0e4fcfc666eda738b1b0c35a3674114 + zip: 29422739ea9b5189c24354f6c689f40485c4dc8945e735c38240094195a637dbc6807f4fe295a1579b27ca930e1eb6b2ad7fe1970dad38d0800e049863e8288b + xz: 7160b1c6fb61b0e369cddccb29eadae85390d86777c875efc18a56de390b1fe1ff47d6e37ccaf39d2ed477c9811f1224cbb3d2f54a0cbd5d5daf418b1cf2557e + - version: 4.0.8 date: 2026-10-22 post: /en/news/2026/10/22/ruby-4-0-8-released/ diff --git a/en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md b/en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md new file mode 100644 index 0000000000..0ab96500f7 --- /dev/null +++ b/en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md @@ -0,0 +1,63 @@ +--- +layout: news_post +title: "Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264" +author: "k0kubun" +translator: +date: 2026-10-23 03:11:22 +0000 +lang: en +--- + +We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby's regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby. + +## Background + +GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with `Regexp.new`. GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab servers. GitLab addressed these issues in its own releases by patching the Ruby it ships, and assigned the following CVE identifiers: + +* [CVE-2026-89078](https://www.cve.org/CVERecord?id=CVE-2026-89078): Double Free issue in Regular Expression Parser ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) +* [CVE-2026-93577](https://www.cve.org/CVERecord?id=CVE-2026-93577): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)) +* [CVE-2026-97229](https://www.cve.org/CVERecord?id=CVE-2026-97229): Integer Overflow issue in CI/CD Regular Expression Compiler ([GitLab 19.4.2](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)) +* [CVE-2026-110264](https://www.cve.org/CVERecord?id=CVE-2026-110264): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)) + +## Fixes in Ruby + +The following table shows the change in Ruby that fixes the bug behind each CVE, and the first release of each series that contains it. + +| GitLab CVE | Bug in Ruby | Change | Ruby 4.0 | Ruby 3.4 | Ruby 3.3 | +|---|---|---|---|---|---| +| CVE-2026-89078 | Double free when parsing a pattern fails after an alternation | [#13332](https://github.com/ruby/ruby/pull/13332) | 4.0.0 | 3.4.12 | 3.3.13 | +| CVE-2026-93577, CVE-2026-97229 | Integer overflow in the size of a compiled pattern | [#19020](https://github.com/ruby/ruby/pull/19020) | 4.0.8 | 3.4.12 | 3.3.13 | +| CVE-2026-110264 | Overflow of internal IDs in a pattern with many repeats | [#16801](https://github.com/ruby/ruby/pull/16801) | 4.0.9 | 3.4.12 | 3.3.13 | + +Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of these fixes. + +## Who is affected + +These bugs are reached only when an application compiles a regular expression from a string that an attacker controls, for example by passing it to `Regexp.new`, `Regexp.union` or `Regexp.compile`, or by interpolating it into a regexp literal such as `/#{input}/`. Applications that only use regular expressions written by their own developers are not affected. + +`Regexp.timeout` does not protect against these bugs. Limiting the length of patterns does not reliably protect against them either, because some of them can be triggered by short patterns. + +## Recommended action + +We recommend upgrading to Ruby 4.0.9, 3.4.12 or 3.3.13 or later. + +If you cannot upgrade, please avoid compiling regular expressions from untrusted input. + +Ruby 3.3 is in the security maintenance phase, in which we normally release only fixes for vulnerabilities. Ruby 3.3.13 includes these fixes as an exception, because GitLab assigned CVEs to issues that rely on them. + +## About CVE identifiers + +We have not requested CVE identifiers in Ruby for these fixes, at least for now. + +Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for [CVE-2022-28738]({% link en/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md %}), where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for [CVE-2024-27282]({% link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %}). + +However, the [Regexp documentation](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts) currently discusses untrusted patterns only in terms of denial of service, and recommends a timeout for them. It does not clearly say whether compiling an untrusted pattern is a use case that Ruby supports. We plan to discuss how to document this, and whether we treat this kind of issue as a vulnerability in Ruby, including whether to request CVE identifiers for these fixes. If we request any, we will update this page. + +In the meantime, please refer to GitLab's CVE identifiers listed above when you track these issues, for example in a security scanner. + +## Credits + +Thanks to Johan Carlsson ([joaxcar](https://github.com/joaxcar)) for discovering the integer overflow fixed by [#19020](https://github.com/ruby/ruby/pull/19020) through GitLab's bug bounty program, and to GitLab for reporting these issues to us and coordinating the fixes. + +## History + +* Originally published at 2026-10-23 03:11:22 (UTC) diff --git a/en/news/_posts/2026-10-23-ruby-4-0-9-released.md b/en/news/_posts/2026-10-23-ruby-4-0-9-released.md new file mode 100644 index 0000000000..6dba399e0c --- /dev/null +++ b/en/news/_posts/2026-10-23-ruby-4-0-9-released.md @@ -0,0 +1,47 @@ +--- +layout: news_post +title: "Ruby 4.0.9 Released" +author: k0kubun +translator: +date: 2026-10-23 03:11:22 +0000 +lang: en +--- + +Ruby 4.0.9 has been released. + +This release includes a fix for a bug in Regexp compilation that GitLab's CVE-2026-110264 relies on. +Please see the topic below for details. + +* [Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264]({% link en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md %}) + +Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v4.0.9) for further details. + +## Download + +{% assign release = site.data.releases | where: "version", "4.0.9" | first %} + +* <{{ release.url.gz }}> + + SIZE: {{ release.size.gz }} + SHA1: {{ release.sha1.gz }} + SHA256: {{ release.sha256.gz }} + SHA512: {{ release.sha512.gz }} + +* <{{ release.url.xz }}> + + SIZE: {{ release.size.xz }} + SHA1: {{ release.sha1.xz }} + SHA256: {{ release.sha256.xz }} + SHA512: {{ release.sha512.xz }} + +* <{{ release.url.zip }}> + + SIZE: {{ release.size.zip }} + SHA1: {{ release.sha1.zip }} + SHA256: {{ release.sha256.zip }} + SHA512: {{ release.sha512.zip }} + +## Release Comment + +Many committers, developers, and users who provided bug reports helped us make this release. +Thanks for their contributions.