Skip to content

Create release for 4.0.9 #4044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
k0kubun merged 2 commits into from
Oct 23, 2026
Merged

Create release for 4.0.9 #4044

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
042e9e3
Create release for 4.0.9
github-actions[bot] Oct 23, 2026
74bd497
Update release note for Ruby 4.0.9
k0kubun Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion _data/downloads.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ preview:

stable:

- 4.0.8
- 4.0.9
- 3.4.11

# optional
Expand Down
24 changes: 24 additions & 0 deletions _data/releases.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,30 @@

# 4.0 series

- version: 4.0.9
date: 2026-10-23
post: /en/news/2026/10/23/ruby-4-0-9-released/
url:
gz: https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.tar.gz
zip: https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.zip
xz: https://cache.ruby-lang.org/pub/ruby/4.0/ruby-4.0.9.tar.xz
size:
gz: 23946524
zip: 29263242
xz: 17996144
sha1:
gz: 39f31360bc0c03bde9eec4177e443f6298481e2e
zip: 9e2d496d0f3663918c3183b8671c7f4b78aa185e
xz: 630cf1e7a4c522f49a2fec383805627691500b54
sha256:
gz: c35350682ff050b79702d57ade4516e7336063f510155d19fb2fb5b3f3909511
zip: 8242fbb2354cb71811cb2ff4d5e149b7a0ecb700e6c61a897710204ac36f866b
xz: a8057adb39f51ad6dc3106237504c93dd792bb515837b4fe7817ae21ed7e51f4
sha512:
gz: 9adb0069a07ee1348a04b627d8af1c9f2b6537bdea5dce0b57423659626d9ae3cc04955eae7167014c56bd0f4c7c9d1aa0e4fcfc666eda738b1b0c35a3674114
zip: 29422739ea9b5189c24354f6c689f40485c4dc8945e735c38240094195a637dbc6807f4fe295a1579b27ca930e1eb6b2ad7fe1970dad38d0800e049863e8288b
xz: 7160b1c6fb61b0e369cddccb29eadae85390d86777c875efc18a56de390b1fe1ff47d6e37ccaf39d2ed477c9811f1224cbb3d2f54a0cbd5d5daf418b1cf2557e

- version: 4.0.8
date: 2026-10-22
post: /en/news/2026/10/22/ruby-4-0-8-released/
Expand Down
63 changes: 63 additions & 0 deletions en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
---
layout: news_post
title: "Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264"
author: "k0kubun"
translator:
date: 2026-10-23 03:11:22 +0000
lang: en
---

We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby's regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying bugs in Ruby.

## Background

GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with `Regexp.new`. GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution on GitLab servers. GitLab addressed these issues in its own releases by patching the Ruby it ships, and assigned the following CVE identifiers:

* [CVE-2026-89078](https://www.cve.org/CVERecord?id=CVE-2026-89078): Double Free issue in Regular Expression Parser ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/))
* [CVE-2026-93577](https://www.cve.org/CVERecord?id=CVE-2026-93577): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.4.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/))
* [CVE-2026-97229](https://www.cve.org/CVERecord?id=CVE-2026-97229): Integer Overflow issue in CI/CD Regular Expression Compiler ([GitLab 19.4.2](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/))
* [CVE-2026-110264](https://www.cve.org/CVERecord?id=CVE-2026-110264): Integer Overflow issue in Regular Expression Compiler ([GitLab 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/))

## Fixes in Ruby

The following table shows the change in Ruby that fixes the bug behind each CVE, and the first release of each series that contains it.

| GitLab CVE | Bug in Ruby | Change | Ruby 4.0 | Ruby 3.4 | Ruby 3.3 |
|---|---|---|---|---|---|
| CVE-2026-89078 | Double free when parsing a pattern fails after an alternation | [#13332](https://github.com/ruby/ruby/pull/13332) | 4.0.0 | 3.4.12 | 3.3.13 |
| CVE-2026-93577, CVE-2026-97229 | Integer overflow in the size of a compiled pattern | [#19020](https://github.com/ruby/ruby/pull/19020) | 4.0.8 | 3.4.12 | 3.3.13 |
| CVE-2026-110264 | Overflow of internal IDs in a pattern with many repeats | [#16801](https://github.com/ruby/ruby/pull/16801) | 4.0.9 | 3.4.12 | 3.3.13 |

Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of these fixes.

## Who is affected

These bugs are reached only when an application compiles a regular expression from a string that an attacker controls, for example by passing it to `Regexp.new`, `Regexp.union` or `Regexp.compile`, or by interpolating it into a regexp literal such as `/#{input}/`. Applications that only use regular expressions written by their own developers are not affected.

`Regexp.timeout` does not protect against these bugs. Limiting the length of patterns does not reliably protect against them either, because some of them can be triggered by short patterns.

## Recommended action

We recommend upgrading to Ruby 4.0.9, 3.4.12 or 3.3.13 or later.

If you cannot upgrade, please avoid compiling regular expressions from untrusted input.

Ruby 3.3 is in the security maintenance phase, in which we normally release only fixes for vulnerabilities. Ruby 3.3.13 includes these fixes as an exception, because GitLab assigned CVEs to issues that rely on them.

## About CVE identifiers

We have not requested CVE identifiers in Ruby for these fixes, at least for now.

Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for [CVE-2022-28738]({% link en/news/_posts/2022-04-12-double-free-in-regexp-compilation-cve-2022-28738.md %}), where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for [CVE-2024-27282]({% link en/news/_posts/2024-04-23-arbitrary-memory-address-read-regexp-cve-2024-27282.md %}).

However, the [Regexp documentation](https://docs.ruby-lang.org/en/master/Regexp.html#class-Regexp-label-Timeouts) currently discusses untrusted patterns only in terms of denial of service, and recommends a timeout for them. It does not clearly say whether compiling an untrusted pattern is a use case that Ruby supports. We plan to discuss how to document this, and whether we treat this kind of issue as a vulnerability in Ruby, including whether to request CVE identifiers for these fixes. If we request any, we will update this page.

In the meantime, please refer to GitLab's CVE identifiers listed above when you track these issues, for example in a security scanner.

## Credits

Thanks to Johan Carlsson ([joaxcar](https://github.com/joaxcar)) for discovering the integer overflow fixed by [#19020](https://github.com/ruby/ruby/pull/19020) through GitLab's bug bounty program, and to GitLab for reporting these issues to us and coordinating the fixes.

## History

* Originally published at 2026-10-23 03:11:22 (UTC)
47 changes: 47 additions & 0 deletions en/news/_posts/2026-10-23-ruby-4-0-9-released.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
---
layout: news_post
title: "Ruby 4.0.9 Released"
author: k0kubun
translator:
date: 2026-10-23 03:11:22 +0000
lang: en
---

Ruby 4.0.9 has been released.

This release includes a fix for a bug in Regexp compilation that GitLab's CVE-2026-110264 relies on.
Please see the topic below for details.

* [Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264]({% link en/news/_posts/2026-10-23-regexp-fixes-for-gitlab-cves.md %})

Please see the [GitHub releases](https://github.com/ruby/ruby/releases/tag/v4.0.9) for further details.

## Download

{% assign release = site.data.releases | where: "version", "4.0.9" | first %}

* <{{ release.url.gz }}>

SIZE: {{ release.size.gz }}
SHA1: {{ release.sha1.gz }}
SHA256: {{ release.sha256.gz }}
SHA512: {{ release.sha512.gz }}

* <{{ release.url.xz }}>

SIZE: {{ release.size.xz }}
SHA1: {{ release.sha1.xz }}
SHA256: {{ release.sha256.xz }}
SHA512: {{ release.sha512.xz }}

* <{{ release.url.zip }}>

SIZE: {{ release.size.zip }}
SHA1: {{ release.sha1.zip }}
SHA256: {{ release.sha256.zip }}
SHA512: {{ release.sha512.zip }}

## Release Comment

Many committers, developers, and users who provided bug reports helped us make this release.
Thanks for their contributions.
Loading