{"id":"CVE-2026-93577","aliases":["ALPINE-CVE-2026-93577","ALSA-2026:96067","ALSA-2026:96068","ALSA-2026:96120","ALSA-2026:96233","ALSA-2026:96235","BELL-CVE-2026-93577","BIT-gitlab-2026-93577","CLSA-2026-1792788765","CLSA-2026-1792788996","CLSA-2026-1792795468","CLSA-2026-1792795609","CLSA-2026-1792795786","CLSA-2026-1792798327","CLSA-2026-1792800480","CLSA-2026-1792801476","DEBIAN-CVE-2026-93577","EUVD-2026-85730","GHSA-wqwg-376r-c226","RLSA-2026:96067","RLSA-2026:96068","RLSA-2026:96120","RLSA-2026:96233","RLSA-2026:96235"],"status":"published","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0063,"percentile":0.50534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-09-23T23:04:45Z","modified":"2026-11-10T12:30:03Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"ruby","fixed_in":["3.3.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"ruby","fixed_in":["3.3.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"gitlab","fixed_in":["19.2.7","19.3.3","19.4.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby3.3","fixed_in":["3.3.13-0+deb13u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-3.module_el9.7.0+184+e2e36072"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-3.module_el9.7.0+184+e2e36072"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.module_el9.7.0+245+447713a2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.module_el9.7.0+245+447713a2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.1.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.9-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Alpaquita:23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-r1"},{"fixed":"3.3.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.4-r0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-r1"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"gitlab","ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.7"},{"introduced":"19.3.0"},{"fixed":"19.3.3"},{"introduced":"19.4.0"},{"fixed":"19.4.1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"ruby3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-7","3.1.2-7+deb12u1","3.1.2-7+hurd.1","3.1.2-8","3.1.2-8.1~exp1","3.1.2-8.3","3.1.2-8.4","3.1.2-8.5"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-0+deb13u1"}]}],"versions":["3.3.8-2","3.3.8-2.1","3.3.8-2.2"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-2","3.3.8-2.1","3.3.8-2.2"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-3.module+el9.7.0+40032+36e56d0d"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.13-16.el10_2"}]}],"bundled":4}],"products":[{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/629758","tags":["Issue Tracking","report","web"]},{"url":"https://hackerone.com/reports/3995696","tags":["technical-description","exploit","permissions-required","Permissions Required","web","report"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","tags":["Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93577","tags":["web","advisory"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released"},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves"},{"url":"https://github.com/advisories/GHSA-wqwg-376r-c226"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-93577","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96067","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110264","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89078","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93577","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97229","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539836","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539842","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550153","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558632","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96067.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96068","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96068.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96120","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96120.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96233","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96233.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96235","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96235.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-93577","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792788765.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792788996.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1792795468.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792795609.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792795786.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792798327.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792800480.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792801476.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93577.json","tags":["advisory"]},{"url":"git://git@gitlab.com:gitlab-org/gitlab.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93577","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96067","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558632","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96068","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96120","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96233","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96235","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-93577","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-23T23:04:45.296Z","modified":"2026-10-30T23:19:55.304Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-85730","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-23T23:04:45Z","modified":"2026-10-30T23:19:55Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:01.632804Z"}],"ghsa":[{"id":"GHSA-wqwg-376r-c226","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19...","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-24T00:30:26Z","modified":"2026-10-31T00:30:31Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:14:53.220001Z"}],"nvd":[{"id":"CVE-2026-93577","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-24T00:17:22.85Z","modified":"2026-10-31T00:16:51.887Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:51.036099Z"}],"osv":[{"id":"ALPINE-CVE-2026-93577","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-24T00:17:22.85Z","modified":"2026-10-27T12:30:04.050720061Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-93577","status":"published","published":"2026-10-28T22:42:06.572352Z","modified":"2026-10-29T07:15:04.345240728Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:27.164451Z"},{"id":"CVE-2026-93577","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-23T23:04:45.296Z","modified":"2026-11-10T12:12:22.590374208Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-09T16:02:38.763385Z"},{"id":"DEBIAN-CVE-2026-93577","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-24T00:17:22.85Z","modified":"2026-11-07T19:00:43.852083715Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"RLSA-2026:96067","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:04:52.928049Z","modified":"2026-11-10T12:30:02.479146368Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96068","title":"Moderate: ruby:3.3 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9] (JIRA:Rocky Linux-290989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-09T12:04:41.930864Z","modified":"2026-11-09T12:30:02.315495757Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T12:55:11.24816Z"},{"id":"RLSA-2026:96120","title":"Moderate: ruby:4.0 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:Rocky Linux-260675)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-09T12:04:41.930864Z","modified":"2026-11-09T12:30:02.318979853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T12:55:11.24816Z"},{"id":"RLSA-2026:96233","title":"Moderate: ruby4.0 security, bug fix, and enhancement update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many features to process text files and to do system management tasks (as in Perl).  It is simple, straight-forward, and extensible.\n\nSecurity Fix(es):\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:Rocky Linux-300942)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:03.480652735Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"RLSA-2026:96235","title":"Moderate: ruby security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-300972)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:03.473148168Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"ALSA-2026:96067","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.412092132Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96068","title":"Moderate: ruby:3.3 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9] (JIRA:RHEL-290989)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.40886572Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96120","title":"Moderate: ruby:4.0 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:RHEL-260675)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.392854445Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96233","title":"Moderate: ruby4.0 security, bug fix, and enhancement update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  \n\nSecurity Fix(es):  \n\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:RHEL-300942)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.417046449Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96235","title":"Moderate: ruby security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:RHEL-300972)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.385421197Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"BIT-gitlab-2026-93577","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.","status":"published","published":"2026-09-29T09:13:03.26Z","modified":"2026-10-01T10:00:06.074549992Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"CLSA-2026-1792788765","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-93577, CVE-2026-97229: fix integer overflow in the regexp\n  compiler's quantifier expansion and program size checks\n- CVE-2026-110264: reject regexps whose repeat or null-check IDs overflow","status":"published","published":"2026-10-23T20:52:57Z","modified":"2026-10-26T09:43:24.127891383Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792788996","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-93577, CVE-2026-97229: fix integer overflow in the regexp\n  compiler's quantifier expansion and program size checks\n- CVE-2026-110264: reject regexps whose repeat or null-check IDs overflow","status":"published","published":"2026-10-23T20:56:49Z","modified":"2026-10-26T09:43:13.728002884Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795468","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in huge regexps\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose range\n       repeat or null check IDs overflow in regcomp.c, regerror.c.\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in the regexp compiler\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the\n       quantifier expansion size without int overflow and reject programs\n       too big for their offset type in regcomp.c, regint.h, regerror.c.\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/patches/exclude-tests-failing-on-build-system.patch: skip the\n       DTrace probe and permission tests, which fail when the test suite runs\n       as root, the TLS tests whose test certificates expired and the\n       Asia/Singapore tests that do not match the installed tzdata","status":"published","published":"2026-10-23T22:44:39Z","modified":"2026-10-26T09:32:03.011735059Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795609","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in regexps\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat\n       or null-check count overflows the ID type in regcomp.c\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in compiled regexps\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check quantifier\n       expansion without int overflow and cap program size in regcomp.c\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/tests/excludes: skip the DTrace probe and two permission tests,\n       which fail when the test suite runs as root, the TLS tests whose\n       test certificates expired and the EADDRINUSE local bind tests","status":"published","published":"2026-10-23T22:47:00Z","modified":"2026-10-26T09:32:04.524033495Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795786","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in Onigmo\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose\n       range-repeat or null-check count overflows the internal ID type in\n       include/ruby/onigmo.h, regcomp.c, regerror.c.\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in Onigmo\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the\n       quantifier expansion size without integer overflow and reject compiled\n       programs too big for their offset type in regcomp.c, regint.h.\n     - CVE-2026-93577\n     - CVE-2026-97229","status":"published","published":"2026-10-23T22:49:56Z","modified":"2026-10-26T09:32:05.624342887Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792798327","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: integer overflow when compiling crafted regexps\n     - debian/patches/CVE-2026-110264.patch: reject overflowed range-repeat\n       and null-check IDs in huge regexps\n     - CVE-2026-110264\n   * SECURITY UPDATE: integer overflow when compiling crafted regexps\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: avoid overflow in\n       the quantifier expansion size check and reject a compiled program too\n       big for its offset type\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/patches/fix-timezone-tests-and-update-expired-certs.patch:\n       replace the expired test certificates and follow the installed\n       tzdata in the Asia/Singapore checks\n     - debian/patches/fix-eaddrinuse-race-in-port0-tests.patch: avoid\n       EADDRINUSE races in tests that listen on a random port\n     - debian/tests/excludes: skip the DTrace probe tests and two\n       permission tests, which fail when the test suite runs as root","status":"published","published":"2026-10-23T23:32:18Z","modified":"2026-10-26T09:31:53.674382203Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792800480","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-110264: regexp: fix out-of-bounds repeat stack access in Onigmo by\n  rejecting patterns whose range-repeat or null-check count overflows the\n  internal ID type\n- CVE-2026-93577, CVE-2026-97229: regexp: fix wrapped jump offsets in Onigmo\n  by checking the quantifier expansion size without integer overflow and\n  rejecting compiled programs too big for their offset type","status":"published","published":"2026-10-24T00:08:13Z","modified":"2026-10-26T09:31:03.087358388Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792801476","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-110264: regexp: fix out-of-bounds repeat stack access in Onigmo by\n  rejecting patterns whose range-repeat or null-check count overflows the\n  internal ID type\n- CVE-2026-93577, CVE-2026-97229: regexp: fix wrapped jump offsets in Onigmo\n  by checking the quantifier expansion size without integer overflow and\n  rejecting compiled programs too big for their offset type","status":"published","published":"2026-10-24T00:24:48Z","modified":"2026-10-26T09:31:37.176885682Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}