Skip to content
Regexp Vulnerabilities in Ruby Releases Addressed

Regexp Vulnerabilities in Ruby Releases Addressed

First seen 23 Oct 2026, 18:14 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 18:47 UTC

On October 23, 2026, multiple Ruby versions were released to address vulnerabilities related to Regexp compilation. These include CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264, all of which have a CVSS score of 9.9 or higher. The vulnerabilities could potentially allow attackers to exploit systems using affected Ruby versions. The releases include Ruby 3.3.13, Ruby 3.4.12, and Ruby 4.0.9, each containing fixes for these vulnerabilities. CVE-2026-110264 was published just a day prior to the release, indicating a rapid response to a newly disclosed issue. Users are encouraged to update their Ruby installations to mitigate the risks associated with these vulnerabilities. The patches are now available on GitHub for all affected versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-27
CVE-2026-80213 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-27
CVE-2026-80212 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-89078 and CVE-2026-93577 published
Both vulnerabilities were disclosed with a CVSS score of 9.9, indicating critical severity.
Article 1
2026-10-13
CVE-2026-97229 published
This critical vulnerability was published with a CVSS score of 10.0, marking it as highly dangerous.
Article 1
2026-10-22
CVE-2026-110264 published
A new critical vulnerability published just before the Ruby releases, with a CVSS score of 10.0.
Article 1
2026-10-23
Ruby versions 3.3.13, 3.4.12, and 4.0.9 released
These releases include critical fixes for multiple Regexp vulnerabilities, urging users to update immediately.
Article 1

More articles in this cluster (3)

Following this threat?

Track CVE-2026-110264 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2

Common questions

Which Ruby versions are affected?
Ruby versions 3.3, 3.4, and 4.0 are affected by the critical vulnerabilities.
Are these vulnerabilities being exploited?
Proof-of-concept code exists for the vulnerabilities, indicating potential for exploitation.
What should I do to protect my systems?
Update to the latest Ruby versions 3.3.13, 3.4.12, or 4.0.9 to mitigate the vulnerabilities.