Ruby Regexp CVEs: alt-ruby Updates for CloudLinux (CVE-2026-97229 and 3 Others)

Ruby published fixes on October 23, 2026, for four vulnerabilities in the regular expression engine that GitLab reported through its own security releases: CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. The CVE IDs were assigned by GitLab. Ruby has not requested IDs for these fixes, so the Ruby advisory refers to GitLab’s CVEs.

Ruby fixed the issues only in 4.0.9, 3.4.12, and 3.3.13. CloudLinux ships Ruby to hosting accounts through Ruby Selector, as alt-ruby packages, so a fix from ruby-lang.org reaches your accounts only when we rebuild those packages and you install them. For lines that upstream no longer maintains, CloudLinux backported the fixes.

Why this matters on a shared host

On a shared server, the Ruby version belongs to each account’s application, not to you. An application is exposed only if it builds a regular expression from text that someone else supplies, for example a search or filter feature that treats user input as a pattern. Applications that use only their own fixed patterns are not affected.

You cannot see from the server side which applications do this, so the practical answer is to update the interpreter. The bugs corrupt memory while Ruby compiles the pattern. GitLab showed that this can be turned into remote code execution on GitLab servers.

Which versions are affected?

The Ruby advisory names the 3.3, 3.4, and 4.0 lines. It does not say whether older lines are affected. CloudLinux therefore backported the fixes to the older lines it ships. The table shows where each package stands.

Ubuntu 24.04: CloudLinux does not release alt-ruby packages for Ubuntu 24.04, because CloudLinux packages are released only for Ubuntu 22.04. TuxCare alt-ruby packages for Ubuntu 24.04 are available with the fix for alt-ruby27, 30, 31, 32, 33, 34, 35, and 40, for example alt-ruby33 3.3.13-15, alt-ruby34 3.4.12-14, and alt-ruby40 4.0.9-9.

alt-ruby18 to alt-ruby25 are not supported, and they receive no security fixes, including for these CVEs. CloudLinux supports alt-ruby26 and newer, and TuxCare ELS for Ruby lists versions 2.6 to 4.0. If you run applications on alt-ruby19 to alt-ruby25, move them to a supported alt-ruby version from the table above.

System Ruby is the interpreter that comes with the operating system, not a Ruby Selector package. CloudLinux does not build it. TuxCare Extended Lifecycle Support (ELS) has released fixed builds of the native Ruby for CentOS 7, RHEL 7, Oracle Linux 7, CloudLinux 7 ELS, Amazon Linux 2, AlmaLinux 9.2 ESU, TuxCare 9.6 ESU, TuxCare 9.8 ESU, Alpine 3.18, Ubuntu 16.04, 18.04, and 20.04, and Debian 10 and 11.

Is there a mitigation?

Yes, with limits. If you cannot update yet, avoid compiling regular expressions from untrusted input. In Ruby that means Regexp.new, Regexp.compile, Regexp.union, and interpolation such as /#{input}/ whenever the input comes from a user, a request, or any other source you do not control.

Two common defenses do not help. Regexp.timeout does not protect, because the bugs occur during compilation and not while matching. Limiting the pattern length does not reliably protect either.

This reduces exposure and does not remove it. The fix is the updated package.

Update instructions

Fixed packages are in the stable repositories, so no testing-channel step is needed.

On CloudLinux 7, 8, and 9 (including EasyApache 4):

# See which Ruby packages are installed
rpm -qa 'alt-ruby*' 'ea-ruby27-ruby'

# Update them
yum update 'alt-ruby*' 'ea-ruby27*'

On CloudLinux for Ubuntu 22.04:

dpkg-query -W 'alt-ruby*'

apt-get update
apt-get install --only-upgrade 'alt-ruby*'

Running applications keep using the old interpreter until they restart. After updating, restart the Ruby applications on each account. To restart one application, run the command below. It takes effect after about 10 seconds.

selectorctl --interpreter=ruby --user=USER --restart-webapp APP_DIR

That command works at the application level. To cover the whole server, restart Apache instead. This takes effect server-wide.

apachectl -k graceful
# or, on cPanel:
/scripts/restartsrv_httpd

CageFS needs no extra step for the alt-ruby and ea-ruby27-ruby packages. For system Ruby, run cagefsctl --force-update.

How to verify you are patched

Check the installed package release against the minimum fixed release in the table.

# CloudLinux 7, 8, 9
rpm -q alt-ruby33

# CloudLinux for Ubuntu 22.04
dpkg-query -W alt-ruby33

A package at the listed release or later is fixed. For example, the CloudLinux 8 and 9 repositories already carry alt-ruby27 2.7.8-152, which is newer than the minimum. The package changelog does not name the CVEs for every package. For alt-ruby33, alt-ruby34, and alt-ruby40, the Ruby version is a second check: 3.3.13, 3.4.12, and 4.0.9 or later. For the backported lines the Ruby version stays the same, so use the package release.

The rest of this advisory is background for readers who want it: how the bugs work and how the four CVEs relate. Neither is required to apply the update above.

What the four CVEs are

All four are in Ruby’s regular expression engine (Onigmo). GitLab showed that a specially crafted pattern can corrupt memory while Ruby compiles it, and that this can be turned into remote code execution on GitLab servers, where users can submit their own patterns.

CVE-2026-89078 does not apply to lines older than Ruby 3.3 (alt-ruby26, 27, 30, 31, 32, and ea-ruby27-ruby): the code it fixes was added in Ruby 3.3.

Severity and disclosure

GitLab disclosed the CVEs in its own patch releases between September 23 and October 22, 2026, before Ruby published its fix. A public proof of concept exists for CVE-2026-97229 (Rapid7 reproduced code execution and links a repository). None was found for the other three. Rapid7 reports no confirmed in-the-wild exploitation of CVE-2026-97229, and the CISA entries in all four CVE records say “Exploitation: none”.

GitLab, as the CNA, rated the CVEs between 9.9 and 10.0 (CVSS 3.1, Critical). Those scores describe GitLab as a product, not Ruby: Ruby’s advisory gives no severity rating. Rapid7 notes that exploiting CVE-2026-97229 on GitLab first requires planting a CI/CD configuration, which the “unauthenticated” rating does not reflect.

Timeline

• 2026-10-26 12:59 UTC: fixed packages also released for TuxCare customers (see Update instructions).
• 2026-10-24 03:30 UTC: fixed packages available in the stable repositories (see Update instructions).
• 2026-10-23 18:48 UTC: first status post. Ruby 4.0.9, 3.4.12, and 3.3.13 had been published upstream, and CloudLinux was rebuilding alt-ruby33, alt-ruby34, and alt-ruby40 and backporting the fixes to the older lines. No CloudLinux packages had been released at that time.

References

• Ruby: Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
• Rapid7: CVE-2026-97229, unauthenticated remote code execution in GitLab
• GitLab 19.4.1 patch release and GitLab 19.5.1 patch release
• Ruby branches and end-of-life dates
• CloudLinux status page incident
• Need help? Contact CloudLinux support