Ruby fixes Regexp flaws tied to four GitLab CVEs

Ruby released regexp compilation fixes for four GitLab CVEs (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). Crafted regular expressions can corrupt memory during compilation in the Onigmo engine, enabling remote code execution; GitLab rated two of them 10.0 under CVSS. Fixes ship in Ruby 4.0.9, 3.4.12 and 3.3.13, while Ruby 3.2 and older get no patch.

• GitLab rated two of the flaws 10.0 under CVSS 3.1, requiring no login
• Fixes land in Ruby 4.0.9, 3.4.12 and 3.3.13; Ruby 3.2 and older unpatched
• Bugs in Onigmo include a double free and integer overflows
• GitLab patched in 19.4.1, 19.4.2 and 19.5.1, with backports