{"id":"CVE-2026-97229","aliases":["ALPINE-CVE-2026-97229","ALSA-2026:96067","ALSA-2026:96068","ALSA-2026:96120","ALSA-2026:96233","ALSA-2026:96235","AZL-111074","BELL-CVE-2026-97229","BIT-gitlab-2026-97229","CLSA-2026-1792788765","CLSA-2026-1792788996","CLSA-2026-1792795468","CLSA-2026-1792795609","CLSA-2026-1792795786","CLSA-2026-1792798327","CLSA-2026-1792800480","CLSA-2026-1792801476","DEBIAN-CVE-2026-97229","EUVD-2026-98214","GHSA-9hj5-r43h-h3xg","RLSA-2026:96067","RLSA-2026:96068","RLSA-2026:96120","RLSA-2026:96233","RLSA-2026:96235","UBUNTU-CVE-2026-97229","openSUSE-SU-2026:12252-1"],"status":"published","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.6522,"percentile":0.9926,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-190"],"published":"2026-10-13T01:05:46Z","modified":"2026-11-10T12:30:03Z","kev":{"date_added":"2026-10-29","due_date":"2026-11-01","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-10-29"},{"source":"kev","since":"2026-10-29"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/gitlab_cicd_regexp_rce_cve_2026_97229","title":"GitLab CI/CD RegExp Integer Overflow Remote Code Execution","type":"exploit","platform":"Linux","date":"2026-10-12","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/gitlab_cicd_regexp_rce_cve_2026_97229"},{"source":"pocgithub","id":"AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE","title":"AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE","date":"2026-10-13","url":"https://github.com/AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE"},{"source":"pocgithub","id":"jburgess-r7/CVE-2026-97229-PoC","title":"jburgess-r7/CVE-2026-97229-PoC","date":"2026-10-13","url":"https://github.com/jburgess-r7/CVE-2026-97229-PoC"},{"source":"pocgithub","id":"gandli/cve-2026-97229-lab","title":"gandli/cve-2026-97229-lab","date":"2026-10-17","url":"https://github.com/gandli/cve-2026-97229-lab"},{"source":"pocgithub","id":"Noshadi-sec/CVE-2026-97229","title":"Noshadi-sec/CVE-2026-97229","date":"2026-10-26","url":"https://github.com/Noshadi-sec/CVE-2026-97229"},{"source":"pocgithub","id":"murat-levi/gitlab-rce-toolkit","title":"murat-levi/gitlab-rce-toolkit","date":"2026-10-29","url":"https://github.com/murat-levi/gitlab-rce-toolkit"},{"source":"pocgithub","id":"foxcornlab/gitlab-onigmo-scanner","title":"foxcornlab/gitlab-onigmo-scanner","date":"2026-10-30","url":"https://github.com/foxcornlab/gitlab-onigmo-scanner"},{"source":"pocgithub","id":"emc-kk/cve-2026-97229-lab","title":"emc-kk/cve-2026-97229-lab","date":"2026-11-03","url":"https://github.com/emc-kk/cve-2026-97229-lab"},{"source":"pocgithub","id":"Certbn/CVE-2026-97229-GitLab-CI-CD","title":"Certbn/CVE-2026-97229-GitLab-CI-CD","date":"2026-11-04","url":"https://github.com/Certbn/CVE-2026-97229-GitLab-CI-CD"},{"source":"pocgithub","id":"Ghost-Bx1/cve-2026-97229-gitlab-ci-rce","title":"Ghost-Bx1/cve-2026-97229-gitlab-ci-rce","date":"2026-11-06","url":"https://github.com/Ghost-Bx1/cve-2026-97229-gitlab-ci-rce"},{"source":"nuclei","id":"CVE-2026-97229","title":"GitLab CE/EE \u003c 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-97229.yaml"}],"fixes":[{"ecosystem":"Alpine:v3.21","package":"ruby","fixed_in":["3.3.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ruby","fixed_in":["3.3.13-0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"ruby","fixed_in":["3.3.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ruby","fixed_in":["3.4.12-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"gitlab","fixed_in":["19.2.8","19.3.5","19.4.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby3.3","fixed_in":["3.3.13-0+deb13u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4.1-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-3.module_el9.7.0+184+e2e36072"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5-3.module_el9.7.0+184+e2e36072"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.module_el9.7.0+245+447713a2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-2.module_el9.7.0+245+447713a2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.1.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.9-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.22-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-r1"},{"fixed":"3.3.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.4-r0"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-r1"},{"fixed":"3.4.12-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"gitlab","ranges":[{"type":"SEMVER","events":[{"introduced":"19.2.0"},{"fixed":"19.2.8"},{"introduced":"19.3.0"},{"fixed":"19.3.5"},{"introduced":"19.4.0"},{"fixed":"19.4.2"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.648-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14.1-39.0.1.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ruby2.3-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ruby2.5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"ruby2.7-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"ruby2.5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-3+deb10u6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-160.el9_2.tuxcare.els22"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.3-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.4.1-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.9-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.7-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.2-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.33-165.el9_6.tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"ruby3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-7","3.1.2-7+deb12u1","3.1.2-7+hurd.1","3.1.2-8","3.1.2-8.1~exp1","3.1.2-8.3","3.1.2-8.4","3.1.2-8.5"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13-0+deb13u1"}]}],"versions":["3.3.8-2","3.3.8-2.1","3.3.8-2.2"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-2","3.3.8-2.1","3.3.8-2.2"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-170.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-3.module+el9.7.0+40032+36e56d0d"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.4-2.module+el9.7.0+40188+314ad260.0.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.9-38.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.13-16.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gitlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.3+dfsg-9","8.4.3+dfsg-12","8.5.8+dfsg-5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-1.1"}]}],"bundled":2}],"products":[{"vendor":"gitlab","product":"community edition and enterprise edition"},{"vendor":"gitlab","product":"gitlab"},{"vendor":"ruby-lang","product":"ruby"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/630686","tags":["Broken Link","report","web"]},{"url":"https://hackerone.com/reports/4055749","tags":["technical-description","exploit","permissions-required","Permissions Required","web","report"]},{"url":"https://hackerone.com/reports/4058589","tags":["technical-description","exploit","permissions-required","Permissions Required","web","report"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","tags":["Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229","tags":["government-resource","US Government Resource","web"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/22017","tags":["Issue Tracking","Third Party Advisory","fix"]},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","tags":["web","advisory"]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released"},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves"},{"url":"https://github.com/advisories/GHSA-9hj5-r43h-h3xg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-97229","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96067","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110264","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89078","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93577","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97229","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539836","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539842","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550153","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558632","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96067.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96068","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96068.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96120","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96120.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96233","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96233.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96235","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96235.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-97229","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792788765.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93577","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792788996.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1792795468.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792795609.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792795786.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792798327.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792800480.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792801476.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97229.json","tags":["advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97229","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96067","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558632","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96068","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96120","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96233","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96235","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-97229","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97229","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97229","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97229","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T01:05:46.166Z","modified":"2026-10-30T23:18:16.598Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:44:18.366073Z"}],"euvd":[{"id":"EUVD-2026-98214","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T01:05:46Z","modified":"2026-10-30T23:18:16Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2026-10-29","updated_at":"2026-11-02T16:59:01.632804Z"}],"ghsa":[{"id":"GHSA-9hj5-r43h-h3xg","title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19...","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T03:30:36Z","modified":"2026-10-31T00:31:32Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:14:53.220001Z"}],"kev":[{"id":"CVE-2026-97229","title":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","description":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","cwes":["CWE-190"],"kev":{"date_added":"2026-10-29","due_date":"2026-11-01","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-97229","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T02:17:00.84Z","modified":"2026-11-02T13:30:16.8Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T20:51:41.281615Z"}],"osv":[{"id":"ALPINE-CVE-2026-97229","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T02:17:00.84Z","modified":"2026-11-03T09:30:03.95835561Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T09:56:52.729801Z"},{"id":"BELL-CVE-2026-97229","status":"published","published":"2026-10-28T22:42:06.898077Z","modified":"2026-10-29T07:15:03.344186905Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"CVE-2026-97229","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T01:05:46.166Z","modified":"2026-11-10T12:12:23.039111124Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-09T16:02:38.763385Z"},{"id":"DEBIAN-CVE-2026-97229","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T02:17:00.84Z","modified":"2026-11-07T19:00:43.57220662Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"RLSA-2026:96067","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:04:52.928049Z","modified":"2026-11-10T12:30:02.479146368Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96068","title":"Moderate: ruby:3.3 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9] (JIRA:Rocky Linux-290989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-09T12:04:41.930864Z","modified":"2026-11-09T12:30:02.315495757Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T12:55:11.24816Z"},{"id":"RLSA-2026:96120","title":"Moderate: ruby:4.0 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:Rocky Linux-260675)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-09T12:04:41.930864Z","modified":"2026-11-09T12:30:02.318979853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T12:55:11.24816Z"},{"id":"RLSA-2026:96233","title":"Moderate: ruby4.0 security, bug fix, and enhancement update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many features to process text files and to do system management tasks (as in Perl).  It is simple, straight-forward, and extensible.\n\nSecurity Fix(es):\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:Rocky Linux-300942)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:03.480652735Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"RLSA-2026:96235","title":"Moderate: ruby security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby: double free issue in regular expression parser (CVE-2026-89078)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n\n* ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n\n* ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\nBug Fix(es) and Enhancement(s):\n\n* ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:Rocky Linux-300972)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:03.473148168Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T12:59:03.619613Z"},{"id":"UBUNTU-CVE-2026-97229","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T02:17:00Z","modified":"2026-10-31T03:30:13.056068245Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:48.647391Z"},{"id":"ALSA-2026:96067","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.412092132Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96068","title":"Moderate: ruby:3.3 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby:3.3/ruby: Rebase to the latest Ruby 3.3 release [rhel-9] (JIRA:RHEL-290989)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.40886572Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96120","title":"Moderate: ruby:4.0 security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby:4.0/ruby: Rebase to the latest Ruby 4.0 release [rhel-9] (JIRA:RHEL-260675)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.392854445Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96233","title":"Moderate: ruby4.0 security, bug fix, and enhancement update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  \n\nSecurity Fix(es):  \n\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby4.0: Rebase to the latest Ruby 4.0 release [rhel-10.2.z] (JIRA:RHEL-300942)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-09T15:30:02.417046449Z","updated_at":"2026-11-09T16:02:40.565923Z"},{"id":"ALSA-2026:96235","title":"Moderate: ruby security, bug fix, and enhancement update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby: double free issue in regular expression parser (CVE-2026-89078)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577)\n  * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229)\n  * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:RHEL-300972)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.385421197Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"AZL-111074","title":"CVE-2026-97229 affecting package ruby for versions less than 3.3.13-0","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-13T02:17:00Z","modified":"2026-11-01T07:13:08Z","updated_at":"2026-11-02T15:28:02.368326Z"},{"id":"BIT-gitlab-2026-97229","title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","status":"published","published":"2026-10-16T09:05:58.25Z","modified":"2026-10-30T10:45:03.086520792Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"CLSA-2026-1792788765","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-93577, CVE-2026-97229: fix integer overflow in the regexp\n  compiler's quantifier expansion and program size checks\n- CVE-2026-110264: reject regexps whose repeat or null-check IDs overflow","status":"published","published":"2026-10-23T20:52:57Z","modified":"2026-10-26T09:43:24.127891383Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792788996","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-93577, CVE-2026-97229: fix integer overflow in the regexp\n  compiler's quantifier expansion and program size checks\n- CVE-2026-110264: reject regexps whose repeat or null-check IDs overflow","status":"published","published":"2026-10-23T20:56:49Z","modified":"2026-10-26T09:43:13.728002884Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795468","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in huge regexps\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose range\n       repeat or null check IDs overflow in regcomp.c, regerror.c.\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in the regexp compiler\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the\n       quantifier expansion size without int overflow and reject programs\n       too big for their offset type in regcomp.c, regint.h, regerror.c.\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/patches/exclude-tests-failing-on-build-system.patch: skip the\n       DTrace probe and permission tests, which fail when the test suite runs\n       as root, the TLS tests whose test certificates expired and the\n       Asia/Singapore tests that do not match the installed tzdata","status":"published","published":"2026-10-23T22:44:39Z","modified":"2026-10-26T09:32:03.011735059Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795609","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in regexps\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat\n       or null-check count overflows the ID type in regcomp.c\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in compiled regexps\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check quantifier\n       expansion without int overflow and cap program size in regcomp.c\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/tests/excludes: skip the DTrace probe and two permission tests,\n       which fail when the test suite runs as root, the TLS tests whose\n       test certificates expired and the EADDRINUSE local bind tests","status":"published","published":"2026-10-23T22:47:00Z","modified":"2026-10-26T09:32:04.524033495Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792795786","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: out-of-bounds repeat stack access in Onigmo\n     - debian/patches/CVE-2026-110264.patch: reject patterns whose\n       range-repeat or null-check count overflows the internal ID type in\n       include/ruby/onigmo.h, regcomp.c, regerror.c.\n     - CVE-2026-110264\n   * SECURITY UPDATE: wrapped jump offsets in Onigmo\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the\n       quantifier expansion size without integer overflow and reject compiled\n       programs too big for their offset type in regcomp.c, regint.h.\n     - CVE-2026-93577\n     - CVE-2026-97229","status":"published","published":"2026-10-23T22:49:56Z","modified":"2026-10-26T09:32:05.624342887Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792798327","title":"Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229","description":"   * SECURITY UPDATE: integer overflow when compiling crafted regexps\n     - debian/patches/CVE-2026-110264.patch: reject overflowed range-repeat\n       and null-check IDs in huge regexps\n     - CVE-2026-110264\n   * SECURITY UPDATE: integer overflow when compiling crafted regexps\n     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: avoid overflow in\n       the quantifier expansion size check and reject a compiled program too\n       big for its offset type\n     - CVE-2026-93577\n     - CVE-2026-97229\n   * Fix build-time test failures:\n     - debian/patches/fix-timezone-tests-and-update-expired-certs.patch:\n       replace the expired test certificates and follow the installed\n       tzdata in the Asia/Singapore checks\n     - debian/patches/fix-eaddrinuse-race-in-port0-tests.patch: avoid\n       EADDRINUSE races in tests that listen on a random port\n     - debian/tests/excludes: skip the DTrace probe tests and two\n       permission tests, which fail when the test suite runs as root","status":"published","published":"2026-10-23T23:32:18Z","modified":"2026-10-26T09:31:53.674382203Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792800480","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-110264: regexp: fix out-of-bounds repeat stack access in Onigmo by\n  rejecting patterns whose range-repeat or null-check count overflows the\n  internal ID type\n- CVE-2026-93577, CVE-2026-97229: regexp: fix wrapped jump offsets in Onigmo\n  by checking the quantifier expansion size without integer overflow and\n  rejecting compiled programs too big for their offset type","status":"published","published":"2026-10-24T00:08:13Z","modified":"2026-10-26T09:31:03.087358388Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792801476","title":"ruby: Fix of 3 CVEs","description":"- CVE-2026-110264: regexp: fix out-of-bounds repeat stack access in Onigmo by\n  rejecting patterns whose range-repeat or null-check count overflows the\n  internal ID type\n- CVE-2026-93577, CVE-2026-97229: regexp: fix wrapped jump offsets in Onigmo\n  by checking the quantifier expansion size without integer overflow and\n  rejecting compiled programs too big for their offset type","status":"published","published":"2026-10-24T00:24:48Z","modified":"2026-10-26T09:31:37.176885682Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12252-1","title":"libruby4_0-4_0-4.0.9-1.1 on GA media","description":"These are all security issues fixed in the libruby4_0-4_0-4.0.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:11.385402527Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}