Bug 2558632 (CVE-2026-110264)

Summary:	CVE-2026-110264 ruby: integer overflow issue in regular expression compiler
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	akhatavk, anthomas, aos-team-art-private, asdas, dpaolell, ehelms, ggainey, jdelft, jpasqual, jupierce, juwatts, lblicha, lgarciaa, mbiarnes, mdellweg, mhulan, nmoumoul, ogajduse, osousa, pcreech, ppalepu, ppostler, prdhamdh, rchan, rhel-process-autobot, sdawley, sghai, sidsharm, smallamp, suppawar, tmalecek, vlaad, watson-tool-maintainers, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Ruby. When compiling a specially crafted regular expression containing an excessive number of repeats with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /#{input}/, an integer overflow of internal IDs can occur. This integer overflow causes memory corruption, potentially resulting in arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-22 00:53:47 UTC

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Comment 10 Jon Orris 2026-11-05 19:41:41 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:95656 https://access.redhat.com/errata/RHSA-2026:95656

Comment 11 Jon Orris 2026-11-05 19:45:17 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:95657 https://access.redhat.com/errata/RHSA-2026:95657

Comment 12 Jon Orris 2026-11-05 19:45:32 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.16 for RHEL 8
  Red Hat Satellite 6.16 for RHEL 9

Via RHSA-2026:95655 https://access.redhat.com/errata/RHSA-2026:95655