Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2-2026-4090 1 CVE

Important: ruby security update (Amazon Linux 2)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-97229: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Fixed packages 16

ReleasePackageFixed in
Amazon Linux · 2 ruby 0:2.0.0.648-36.amzn2.0.21
Amazon Linux · 2 ruby-debuginfo 0:2.0.0.648-36.amzn2.0.21
Amazon Linux · 2 ruby-devel 0:2.0.0.648-36.amzn2.0.21
Amazon Linux · 2 ruby-doc 0:2.0.0.648-36.amzn2.0.21
Amazon Linux · 2 ruby-irb 0:2.0.0.648-36.amzn2.0.21
Amazon Linux · 2 ruby-libs 0:2.0.0.648-36.amzn2.0.21
Amazon Linux · 2 ruby-tcltk 0:2.0.0.648-36.amzn2.0.21
Amazon Linux · 2 rubygem-bigdecimal 0:1.2.0-36.amzn2.0.21
Amazon Linux · 2 rubygem-io-console 0:0.4.2-36.amzn2.0.21
Amazon Linux · 2 rubygem-json 0:1.7.7-36.amzn2.0.21
Amazon Linux · 2 rubygem-minitest 0:4.3.2-36.amzn2.0.21
Amazon Linux · 2 rubygem-psych 0:2.0.0-36.amzn2.0.21
Amazon Linux · 2 rubygem-rake 0:0.9.6-36.amzn2.0.21
Amazon Linux · 2 rubygem-rdoc 0:4.0.0-36.amzn2.0.21
Amazon Linux · 2 rubygems 0:2.0.14.1-36.amzn2.0.21
Amazon Linux · 2 rubygems-devel 0:2.0.14.1-36.amzn2.0.21

Vulnerabilities 1

  • Critical 10.0
    CVE-2026-97229 Exploited Public exploit Scanner template EPSS 69%

    Integer Overflow or Wraparound in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

    GitLab GitLab gitlab ruby Web / CMS Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 29, 2026

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-97229.html