Skip to content
OpenAdvisories
Medium 1 exploited CVE ALSA-2026:96067 4 CVEs

Moderate: ruby security update

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: AlmaLinux

Summary

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* ruby: double free issue in regular expression parser (CVE-2026-89078)
* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)
* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)
* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 22

ReleasePackageFixed in
AlmaLinux · 9 ruby 3.0.7-170.el9_8
AlmaLinux · 9 ruby-default-gems 3.0.7-170.el9_8
AlmaLinux · 9 ruby-devel 3.0.7-170.el9_8
AlmaLinux · 9 ruby-doc 3.0.7-170.el9_8
AlmaLinux · 9 ruby-libs 3.0.7-170.el9_8
AlmaLinux · 9 rubygem-bigdecimal 3.0.0-170.el9_8
AlmaLinux · 9 rubygem-bundler 2.2.33-170.el9_8
AlmaLinux · 9 rubygem-io-console 0.5.7-170.el9_8
AlmaLinux · 9 rubygem-irb 1.3.5-170.el9_8
AlmaLinux · 9 rubygem-json 2.5.1-170.el9_8
AlmaLinux · 9 rubygem-minitest 5.14.2-170.el9_8
AlmaLinux · 9 rubygem-power_assert 1.2.1-170.el9_8
AlmaLinux · 9 rubygem-psych 3.3.2-170.el9_8
AlmaLinux · 9 rubygem-rake 13.0.3-170.el9_8
AlmaLinux · 9 rubygem-rbs 1.4.0-170.el9_8
AlmaLinux · 9 rubygem-rdoc 6.3.4.1-170.el9_8
AlmaLinux · 9 rubygem-rexml 3.2.5-170.el9_8
AlmaLinux · 9 rubygem-rss 0.2.9-170.el9_8
AlmaLinux · 9 rubygem-test-unit 3.3.7-170.el9_8
AlmaLinux · 9 rubygem-typeprof 0.15.2-170.el9_8
AlmaLinux · 9 rubygems 3.2.33-170.el9_8
AlmaLinux · 9 rubygems-devel 3.2.33-170.el9_8

Vulnerabilities 4

  • Critical 10.0
    CVE-2026-97229 Exploited Public exploit Scanner template EPSS 69%

    Integer Overflow or Wraparound in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

    GitLab GitLab gitlab ruby Web / CMS Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 29, 2026
  • Critical 10.0
    CVE-2026-110264 Public exploit

    Integer Overflow or Wraparound in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could hav…

    GitLab GitLab ruby ruby3.1 Web / CMS Debian Azure Linux Alpine Wolfi
  • Critical 9.9
    CVE-2026-89078

    Double Free in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…

    GitLab GitLab ruby gitlab-runner-helper-19.2 Web / CMS Debian Alpine Wolfi
  • Critical 9.9
    CVE-2026-93577

    Integer Overflow or Wraparound in GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…

    GitLab GitLab ruby gitlab-runner-19.2 Web / CMS Debian Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-110264
  • report
    https://access.redhat.com/security/cve/CVE-2026-89078
  • report
    https://access.redhat.com/security/cve/CVE-2026-93577
  • report
    https://access.redhat.com/security/cve/CVE-2026-97229
  • report
    https://bugzilla.redhat.com/2539836
  • report
    https://bugzilla.redhat.com/2539842
  • report
    https://bugzilla.redhat.com/2550153
  • report
    https://bugzilla.redhat.com/2558632
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-96067.html