{"id":"CVE-2026-110264","aliases":["ALPINE-CVE-2026-110264","ALSA-2026:96067","ALSA-2026:96068","ALSA-2026:96120","ALSA-2026:96233","ALSA-2026:96235","AZL-111071","BELL-CVE-2026-110264","BIT-gitlab-2026-110264","CLSA-2026-1792788765","CLSA-2026-1792788996","CLSA-2026-1792795468","CLSA-2026-1792795609","CLSA-2026-1792795786","CLSA-2026-1792798327","CLSA-2026-1792800480","CLSA-2026-1792801476","DEBIAN-CVE-2026-110264","EUVD-2026-107696","GHSA-83vq-rvff-66gw","RLSA-2026:96067","RLSA-2026:96068","RLSA-2026:96120","RLSA-2026:96233","RLSA-2026:96235"],"status":"published","title":"Integer Overflow or Wraparound in GitLab","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01349,"percentile":0.71686,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-190"],"published":"2026-10-22T00:33:48Z","modified":"2026-11-10T12:30:03Z","exploits":[{"source":"pocgithub","id":"TahuCryptsi/gitlab-onigmo-check","title":"TahuCryptsi/gitlab-onigmo-check","date":"2026-10-22","url":"https://github.com/TahuCryptsi/gitlab-onigmo-check"},{"source":"pocgithub","id":"TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264","title":"TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264","date":"2026-10-22","url":"https://github.com/TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264"},{"source":"pocgithub","id":"al4n4n/CVE-2026-110264","title":"al4n4n/CVE-2026-110264","date":"2026-10-22","url":"https://github.com/al4n4n/CVE-2026-110264"},{"source":"pocgithub","id":"xaviware/go-gitlab-cve-2026-110264-scanner","title":"xaviware/go-gitlab-cve-2026-110264-scanner","date":"2026-10-22","url":"https://github.com/xaviware/go-gitlab-cve-2026-110264-scanner"},{"source":"pocgithub","id":"FranklinF25/regex2shell","title":"FranklinF25/regex2shell","date":"2026-10-23","url":"https://github.com/FranklinF25/regex2shell"},{"source":"pocgithub","id":"TheGlitchFixer/gitlab-patch-check","title":"TheGlitchFixer/gitlab-patch-check","date":"2026-10-23","url":"https://github.com/TheGlitchFixer/gitlab-patch-check"},{"source":"pocgithub","id":"bastet-ai/gitlab-firing-range","title":"bastet-ai/gitlab-firing-range","date":"2026-10-23","url":"https://github.com/bastet-ai/gitlab-firing-range"},{"source":"pocgithub","id":"farimazhar/GitLab2Safe-Defensive-Checker","title":"farimazhar/GitLab2Safe-Defensive-Checker","date":"2026-10-23","url":"https://github.com/farimazhar/GitLab2Safe-Defensive-Checker"},{"source":"pocgithub","id":"lesterlam/onigmo-cve-2026-110264","title":"lesterlam/onigmo-cve-2026-110264","date":"2026-10-23","url":"https://github.com/lesterlam/onigmo-cve-2026-110264"},{"source":"pocgithub","id":"Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE","title":"Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE","date":"2026-10-24","url":"https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE"},{"source":"pocgithub","id":"googlesky/CVE-2026-110264","title":"googlesky/CVE-2026-110264","date":"2026-10-24","url":"https://github.com/googlesky/CVE-2026-110264"}],"fixes":[{"ecosystem":"Alpine:v3.21","package":"ruby","fixed_in":["3.3.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ruby","fixed_in":["3.3.13-0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"ruby","fixed_in":["3.3.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"gitlab","fixed_in":["18.11.13","19.0.10","19.1.9","19.2.9","19.3.6","19.4.3","19.5.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby3.3","fixed_in":["3.3.13-0+deb13u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-3.module_el9.7.0+184+e2e36072"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-3.module_el9.7.0+184+e2e36072"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.module_el9.7.0+245+447713a2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.module_el9.7.0+245+447713a2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.1.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.9-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-r1"},{"fixed":"3.3.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.4-r0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-r1"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"gitlab","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"18.11.13"},{"introduced":"19.0.0"},{"fixed":"19.0.10"},{"introduced":"19.1.0"},{"fixed":"19.1.9"},{"introduced":"19.2.0"},{"fixed":"19.2.9"},{"introduced":"19.3.0"},{"fixed":"19.3.6"},{"introduced":"19.4.0"},{"fixed":"19.4.3"},{"introduced":"19.5.0"},{"fixed":"19.5.1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"ruby3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-7","3.1.2-7+deb12u1","3.1.2-7+hurd.1","3.1.2-8","3.1.2-8.1~exp1","3.1.2-8.3","3.1.2-8.4","3.1.2-8.5"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-0+deb13u1"}]}],"versions":["3.3.8-2","3.3.8-2.1","3.3.8-2.2"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-2","3.3.8-2.1","3.3.8-2.2"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-3.module+el9.7.0+40032+36e56d0d"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.13-16.el10_2"}]}],"bundled":4}],"products":[{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/633633","tags":["Permissions Required","web"]},{"url":"https://hackerone.com/reports/4093475","tags":["technical-description","exploit","permissions-required","Permissions Required","web","report"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","tags":["Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","tags":["web","advisory"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released"},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves"},{"url":"https://github.com/advisories/GHSA-83vq-rvff-66gw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-110264","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96067","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110264","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89078","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93577","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97229","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539836","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539842","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550153","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558632","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96067.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96068","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96068.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96120","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96120.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96233","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96233.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96235","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96235.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-110264","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792788765.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792788996.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1792795468.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792795609.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792795786.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792798327.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792800480.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792801476.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110264.json","tags":["advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110264","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96067","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558632","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96068","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96120","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96233","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96235","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-110264","title":"Integer Overflow or Wraparound in GitLab","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T00:33:48.179Z","modified":"2026-10-30T23:20:24.882Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-107696","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T00:33:48Z","modified":"2026-10-30T23:20:24Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:01.632804Z"}],"ghsa":[{"id":"GHSA-83vq-rvff-66gw","title":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19...","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T03:33:33Z","modified":"2026-10-31T00:31:32Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:14:53.220001Z"}],"nvd":[{"id":"CVE-2026-110264","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T01:16:57.603Z","modified":"2026-11-04T23:10:00.223Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T01:45:12.506753Z"}],"osv":[{"id":"ALPINE-CVE-2026-110264","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T01:16:57.603Z","modified":"2026-10-27T12:30:02.53934389Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-110264","status":"published","published":"2026-10-28T22:42:07.205013Z","modified":"2026-10-29T07:15:04.251298098Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-110264","title":"Integer Overflow or Wraparound in GitLab","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T00:33:48.179Z","modified":"2026-11-10T12:12:23.00498968Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-09T16:02:38.763385Z"},{"id":"DEBIAN-CVE-2026-110264","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T01:16:57.603Z","modified":"2026-11-07T19:00:42.121558408Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"RLSA-2026:96067","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:04:52.928049Z","modified":"2026-11-10T12:30:02.479146368Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96068","title":"Moderate: ruby:3.3 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9] (JIRA:Rocky Linux-290989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-09T12:04:41.930864Z","modified":"2026-11-09T12:30:02.315495757Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T12:55:11.24816Z"},{"id":"RLSA-2026:96120","title":"Moderate: ruby:4.0 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:Rocky Linux-260675)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-09T12:04:41.930864Z","modified":"2026-11-09T12:30:02.318979853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T12:55:11.24816Z"},{"id":"RLSA-2026:96233","title":"Moderate: ruby4.0 security, bug fix, and enhancement update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many features to process text files and to do system management tasks (as in Perl).  It is simple, straight-forward, and extensible.\n\nSecurity Fix(es):\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:Rocky Linux-300942)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:03.480652735Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"RLSA-2026:96235","title":"Moderate: ruby security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-300972)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:03.473148168Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"ALSA-2026:96067","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.412092132Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96068","title":"Moderate: ruby:3.3 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9] (JIRA:RHEL-290989)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.40886572Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96120","title":"Moderate: ruby:4.0 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:RHEL-260675)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.392854445Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96233","title":"Moderate: ruby4.0 security, bug fix, and enhancement update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  \n\nSecurity Fix(es):  \n\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:RHEL-300942)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.417046449Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96235","title":"Moderate: ruby security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:RHEL-300972)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.385421197Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"AZL-111071","title":"CVE-2026-110264 affecting package ruby for versions less than 3.3.13-0","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-22T01:16:57Z","modified":"2026-11-01T07:13:08Z","updated_at":"2026-11-02T15:28:02.368326Z"},{"id":"BIT-gitlab-2026-110264","title":"Integer Overflow or Wraparound in GitLab","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","status":"published","published":"2026-10-29T09:10:13.82Z","modified":"2026-10-29T10:45:02.810793164Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"CLSA-2026-1792788765","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-93577, CVE-2026-97229: fix integer overflow in the regexp\n  compiler's quantifier expansion and program size checks\n- CVE-2026-110264: reject regexps whose repeat or null-check IDs overflow","status":"published","published":"2026-10-23T20:52:57Z","modified":"2026-10-26T09:43:24.127891383Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792788996","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-93577, CVE-2026-97229: fix integer overflow in the regexp\n  compiler's quantifier expansion and program size checks\n- CVE-2026-110264: reject regexps whose repeat or null-check IDs overflow","status":"published","published":"2026-10-23T20:56:49Z","modified":"2026-10-26T09:43:13.728002884Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795468","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in huge regexps\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose range\n       repeat or null check IDs overflow in regcomp.c, regerror.c.\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in the regexp compiler\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the\n       quantifier expansion size without int overflow and reject programs\n       too big for their offset type in regcomp.c, regint.h, regerror.c.\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/patches/exclude-tests-failing-on-build-system.patch: skip the\n       DTrace probe and permission tests, which fail when the test suite runs\n       as root, the TLS tests whose test certificates expired and the\n       Asia/Singapore tests that do not match the installed tzdata","status":"published","published":"2026-10-23T22:44:39Z","modified":"2026-10-26T09:32:03.011735059Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795609","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in regexps\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat\n       or null-check count overflows the ID type in regcomp.c\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in compiled regexps\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check quantifier\n       expansion without int overflow and cap program size in regcomp.c\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/tests/excludes: skip the DTrace probe and two permission tests,\n       which fail when the test suite runs as root, the TLS tests whose\n       test certificates expired and the EADDRINUSE local bind tests","status":"published","published":"2026-10-23T22:47:00Z","modified":"2026-10-26T09:32:04.524033495Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795786","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in Onigmo\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose\n       range-repeat or null-check count overflows the internal ID type in\n       include/ruby/onigmo.h, regcomp.c, regerror.c.\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in Onigmo\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the\n       quantifier expansion size without integer overflow and reject compiled\n       programs too big for their offset type in regcomp.c, regint.h.\n     - CVE-2026-93577\n     - CVE-2026-97229","status":"published","published":"2026-10-23T22:49:56Z","modified":"2026-10-26T09:32:05.624342887Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792798327","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: integer overflow when compiling crafted regexps\n     - debian/patches/CVE-2026-110264.patch: reject overflowed range-repeat\n       and null-check IDs in huge regexps\n     - CVE-2026-110264\n   * SECURITY UPDATE: integer overflow when compiling crafted regexps\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: avoid overflow in\n       the quantifier expansion size check and reject a compiled program too\n       big for its offset type\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/patches/fix-timezone-tests-and-update-expired-certs.patch:\n       replace the expired test certificates and follow the installed\n       tzdata in the Asia/Singapore checks\n     - debian/patches/fix-eaddrinuse-race-in-port0-tests.patch: avoid\n       EADDRINUSE races in tests that listen on a random port\n     - debian/tests/excludes: skip the DTrace probe tests and two\n       permission tests, which fail when the test suite runs as root","status":"published","published":"2026-10-23T23:32:18Z","modified":"2026-10-26T09:31:53.674382203Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792800480","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-110264: regexp: fix out-of-bounds repeat stack access in Onigmo by\n  rejecting patterns whose range-repeat or null-check count overflows the\n  internal ID type\n- CVE-2026-93577, CVE-2026-97229: regexp: fix wrapped jump offsets in Onigmo\n  by checking the quantifier expansion size without integer overflow and\n  rejecting compiled programs too big for their offset type","status":"published","published":"2026-10-24T00:08:13Z","modified":"2026-10-26T09:31:03.087358388Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792801476","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-110264: regexp: fix out-of-bounds repeat stack access in Onigmo by\n  rejecting patterns whose range-repeat or null-check count overflows the\n  internal ID type\n- CVE-2026-93577, CVE-2026-97229: regexp: fix wrapped jump offsets in Onigmo\n  by checking the quantifier expansion size without integer overflow and\n  rejecting compiled programs too big for their offset type","status":"published","published":"2026-10-24T00:24:48Z","modified":"2026-10-26T09:31:37.176885682Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}