Ruby: four CVE in regex engine, CloudLinux updates alt-ruby packages

On 23 October 2026, Ruby published versions 4.0.9, 3.4.12 and 3.3.13, which fix four memory corruption bugs in the regular expression engine (Onigmo). CloudLinux has consequently recompiled the alt-ruby packages for Ruby Selector, because on shared hosting the upstream patch does not reach user accounts until the control panel vendor distributes it.

Where the CVE identifiers come from

The four identifiers — CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 — were assigned by GitLab, not Ruby. GitLab compiles regular expression rules supplied by users, such as patterns in CI configuration, with Regexp.new, and discovered that specially crafted patterns could corrupt memory during compilation, turning into remote code execution on GitLab servers. GitLab fixed the issue by updating to versions 19.2.8, 19.3.5 and 19.4.2, released on 12 October 2026, eleven days before the patch on Ruby's side. For CVE-2026-97229 there exists public proof-of-concept, used by Rapid7 to reproduce code execution; for the other three CVE neither public PoC nor confirmed exploitation in the wild have been reported.

Who is exposed on shared hosting

The risk only affects Ruby applications that compile a regex from text supplied by third parties (a search or filter function that treats user input as a pattern). Apps that only use patterns written by their own developers are not affected, but from the server side it is impossible to distinguish between the two cases: the practical response remains to update the interpreter. Regexp.timeout does not protect, because the bug happens during compilation and not during matching; limiting pattern length is not a reliable mitigation.

Packages and minimum corrected versions

Package	Minimum corrected version (CL 7/8/9)	Minimum corrected version (Ubuntu 22.04)
alt-ruby26	2.6.10-20	not distributed
alt-ruby27	2.7.8-151	2.7.8-11
alt-ruby30	3.0.7-175	3.0.7-177
alt-ruby31	3.1.7-15	3.1.7-15
alt-ruby32	3.2.11-16	3.2.11-16
alt-ruby33	3.3.13-14	3.3.13-15
alt-ruby34	3.4.12-13	3.4.12-14
alt-ruby35	3.5.0-0.6.preview1	3.5.0~preview1-7
alt-ruby40	4.0.9-8	4.0.9-9
ea-ruby27-ruby	2.7.8-6.el7/el8.cloudlinux.1	not distributed

The alt-ruby18 through alt-ruby25 lines are unsupported and do not receive fixes: anyone still using them must migrate to a supported version. System Ruby (CloudLinux 10 and the module streams of CloudLinux 8/9) does not yet have a correct build from the operating system vendor.

Commands to update

On CloudLinux 7, 8, 9 (including EasyApache 4):

rpm -qa 'alt-ruby*' 'ea-ruby27-ruby'
yum update 'alt-ruby*' 'ea-ruby27*'

On CloudLinux for Ubuntu 22.04:

dpkg-query -W 'alt-ruby*'
apt-get update
apt-get install --only-upgrade 'alt-ruby*'

Already running applications continue to use the old interpreter until they are restarted. To restart a single app:

selectorctl --interpreter=ruby --user=USER --restart-webapp APP_DIR

To cover the entire server: apachectl -k graceful (or, on cPanel, /scripts/restartsrv_httpd). For system Ruby also cagefsctl --force-update is needed.

Those using TuxCare packages will find the fix on the repository repo.alt.tuxcare.com, also available for Ubuntu 24.04, where CloudLinux does not distribute its own alt-ruby packages.