CVE-2026-93577

ruby3.3: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, an...

CVE-2026-93577 is fixed in 99 products on 1 platform, first by DEBIAN-CVE-2026-93577, released September 24, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

Urgent
CVSS
9.9
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0063
50th percentile

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

Where it's fixed

ProductFixed inFixReleased
Linux
ruby · RHEL 10 3.3.13-16.el10_2 RHSA-2026:96235 Nov 10, 2026
ruby · RHEL 9 0:4.0.9-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
ruby · almalinux 9 3.0.7-170.el9_8 ALSA-2026:96067 Nov 10, 2026
ruby · ol 10 0:3.3.13-16.el10_2 ELSA-2026-96235 Nov 10, 2026
ruby-bundled-gems · RHEL 9 0:4.0.9-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
ruby-bundled-gems · ol 10 0:3.3.13-16.el10_2 ELSA-2026-96235 Nov 10, 2026
ruby-default-gems · RHEL 9 0:4.0.9-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
ruby-default-gems · almalinux 9 3.0.7-170.el9_8 ALSA-2026:96067 Nov 10, 2026
ruby-default-gems · ol 10 0:3.3.13-16.el10_2 ELSA-2026-96235 Nov 10, 2026
ruby-devel · RHEL 9 0:4.0.9-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
ruby-devel · almalinux 9 3.0.7-170.el9_8 ALSA-2026:96067 Nov 10, 2026
ruby-devel · ol 10 0:3.3.13-16.el10_2 ELSA-2026-96235 Nov 10, 2026
ruby-doc · RHEL 9 0:4.0.9-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
ruby-doc · almalinux 9 3.0.7-170.el9_8 ALSA-2026:96067 Nov 10, 2026
ruby-doc · ol 10 0:3.3.13-16.el10_2 ELSA-2026-96235 Nov 10, 2026
ruby-libs · RHEL 9 0:4.0.9-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
ruby-libs · almalinux 9 3.0.7-170.el9_8 ALSA-2026:96067 Nov 10, 2026
ruby-libs · ol 10 0:3.3.13-16.el10_2 ELSA-2026-96235 Nov 10, 2026
ruby3.3 · Debian 13.5 (trixie) 3.3.13-0+deb13u1 DEBIAN-CVE-2026-93577 Sep 24, 2026
ruby3.4 · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-bundled-gems · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-bundled-gems-debuginfo · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-debuginfo · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-debugsource · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-default-gems · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-devel · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-doc · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-libs · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-libs-debuginfo · amzn 2023 3.4.12-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-bigdecimal · amzn 2023 3.1.8-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-bigdecimal-debuginfo · amzn 2023 3.1.8-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-bundler · amzn 2023 2.6.9-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-io-console · amzn 2023 0.8.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-io-console-debuginfo · amzn 2023 0.8.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-irb · amzn 2023 1.14.3-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-json · amzn 2023 2.9.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-json-debuginfo · amzn 2023 2.9.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-minitest · amzn 2023 5.25.4-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-power_assert · amzn 2023 2.0.5-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-psych · amzn 2023 5.2.2-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-psych-debuginfo · amzn 2023 5.2.2-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-racc · amzn 2023 1.8.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-racc-debuginfo · amzn 2023 1.8.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-rake · amzn 2023 13.2.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-rbs · amzn 2023 3.8.0-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-rbs-debuginfo · amzn 2023 3.8.0-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-rdoc · amzn 2023 6.14.0-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-rexml · amzn 2023 3.4.4-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-rss · amzn 2023 0.3.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-test-unit · amzn 2023 3.6.7-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygem-typeprof · amzn 2023 0.30.1-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygems · amzn 2023 3.6.9-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby3.4-rubygems-devel · amzn 2023 3.6.9-27.amzn2023.0.8 ALAS2023-2026-3413 Nov 10, 2026
ruby4.0 · RHEL 10 4.0.9-38.el10_2 RHSA-2026:96233 Nov 10, 2026
ruby4.0 · almalinux 10 4.0.9-38.el10_2 ALSA-2026:96233 Nov 10, 2026
ruby4.0 · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0 · ol 10 0:4.0.9-38.el10_2 ELSA-2026-96233 Nov 10, 2026
ruby4.0-bundled-gems · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-bundled-gems-debuginfo · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-debuginfo · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-debugsource · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-default-gems · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-devel · almalinux 10 4.0.9-38.el10_2 ALSA-2026:96233 Nov 10, 2026
ruby4.0-devel · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-devel · ol 10 0:4.0.9-38.el10_2 ELSA-2026-96233 Nov 10, 2026
ruby4.0-doc · almalinux 10 4.0.9-38.el10_2 ALSA-2026:96233 Nov 10, 2026
ruby4.0-doc · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-doc · ol 10 0:4.0.9-38.el10_2 ELSA-2026-96233 Nov 10, 2026
ruby4.0-libs · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-libs-debuginfo · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-bigdecimal · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-bigdecimal-debuginfo · amzn 2023 4.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-bundler · amzn 2023 4.0.3-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-io-console · amzn 2023 0.8.2-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-io-console-debuginfo · amzn 2023 0.8.2-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-irb · amzn 2023 1.16.0-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-json · amzn 2023 2.18.0-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-json-debuginfo · amzn 2023 2.18.0-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-minitest · amzn 2023 6.0.0-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-mysql2 · almalinux 10 0.5.7-38.el10_2 ALSA-2026:96233 Nov 10, 2026
ruby4.0-rubygem-mysql2 · ol 10 0:0.5.7-38.el10_2 ELSA-2026-96233 Nov 10, 2026
ruby4.0-rubygem-pg · almalinux 10 1.6.3-38.el10_2 ALSA-2026:96233 Nov 10, 2026
ruby4.0-rubygem-pg · ol 10 0:1.6.3-38.el10_2 ELSA-2026-96233 Nov 10, 2026
ruby4.0-rubygem-power_assert · amzn 2023 3.0.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-psych · amzn 2023 5.3.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-psych-debuginfo · amzn 2023 5.3.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-racc · amzn 2023 1.8.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-racc-debuginfo · amzn 2023 1.8.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-rake · amzn 2023 13.3.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-rbs · amzn 2023 3.10.0-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-rbs-debuginfo · amzn 2023 3.10.0-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-rdoc · amzn 2023 7.0.3-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-rexml · amzn 2023 3.4.4-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-rss · amzn 2023 0.3.2-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-test-unit · amzn 2023 3.7.5-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygem-typeprof · amzn 2023 0.31.1-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygems · amzn 2023 4.0.3-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
ruby4.0-rubygems-devel · amzn 2023 4.0.3-32.amzn2023.0.5 ALAS2023-2026-3400 Nov 10, 2026
rubygem-bigdecimal · RHEL 9 0:4.0.1-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-bigdecimal · almalinux 9 3.0.0-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-bigdecimal · ol 10 0:3.1.5-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-bundler · RHEL 9 0:4.0.20-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-bundler · almalinux 9 2.2.33-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-bundler · ol 10 0:2.5.22-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-io-console · RHEL 9 0:0.8.2-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-io-console · almalinux 9 0.5.7-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-io-console · ol 10 0:0.7.1-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-irb · RHEL 9 0:1.16.0-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-irb · almalinux 9 1.3.5-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-irb · ol 10 0:1.13.1-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-json · RHEL 9 0:2.18.0-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-json · almalinux 9 2.5.1-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-json · ol 10 0:2.7.2-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-minitest · RHEL 9 0:6.0.0-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-minitest · almalinux 9 5.14.2-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-minitest · ol 10 0:5.20.0-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-mysql2 · RHEL 9 0:0.5.7-1.module+el9.8.0+24428+77f1d00a RHSA-2026:96120 Nov 10, 2026
rubygem-mysql2 · almalinux 9 0.5.7-1.module_el9.8.0+232+50f6dd36 ALSA-2026:96120 Nov 10, 2026
rubygem-mysql2 · rocky 9 0:0.5.7-1.module+el9.8.0+40094+ce01217c RLSA-2026:96120 Nov 10, 2026
rubygem-mysql2-doc · RHEL 9 0:0.5.7-1.module+el9.8.0+24428+77f1d00a RHSA-2026:96120 Nov 10, 2026
rubygem-mysql2-doc · almalinux 9 0.5.7-1.module_el9.8.0+232+50f6dd36 ALSA-2026:96120 Nov 10, 2026
rubygem-pg · RHEL 9 0:1.6.3-1.module+el9.8.0+24428+77f1d00a RHSA-2026:96120 Nov 10, 2026
rubygem-pg · almalinux 9 1.6.3-1.module_el9.8.0+232+50f6dd36 ALSA-2026:96120 Nov 10, 2026
rubygem-pg · rocky 9 0:1.6.3-1.module+el9.8.0+40094+ce01217c RLSA-2026:96120 Nov 10, 2026
rubygem-pg-doc · RHEL 9 0:1.6.3-1.module+el9.8.0+24428+77f1d00a RHSA-2026:96120 Nov 10, 2026
rubygem-pg-doc · almalinux 9 1.6.3-1.module_el9.8.0+232+50f6dd36 ALSA-2026:96120 Nov 10, 2026
rubygem-power_assert · RHEL 9 0:3.0.1-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-power_assert · almalinux 9 1.2.1-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-power_assert · ol 10 0:2.0.3-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-psych · RHEL 9 0:5.3.1-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-psych · almalinux 9 3.3.2-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-psych · ol 10 0:5.1.2-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-racc · RHEL 9 0:1.8.1-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-racc · ol 10 0:1.7.3-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-rake · RHEL 9 0:13.3.1-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-rake · almalinux 9 13.0.3-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-rake · ol 10 0:13.1.0-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-rbs · RHEL 9 0:3.10.0-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-rbs · almalinux 9 1.4.0-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-rbs · ol 10 0:3.4.0-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-rdoc · RHEL 9 0:7.0.4-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-rdoc · almalinux 9 6.3.4.1-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-rdoc · ol 10 0:6.6.3.1-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-rexml · RHEL 9 0:3.4.4-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-rexml · almalinux 9 3.2.5-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-rexml · ol 10 0:3.4.4-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-rss · RHEL 9 0:0.3.2-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-rss · almalinux 9 0.2.9-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-rss · ol 10 0:0.3.1-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-test-unit · RHEL 9 0:3.7.5-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-test-unit · almalinux 9 3.3.7-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-test-unit · ol 10 0:3.6.1-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygem-typeprof · RHEL 9 0:0.31.1-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygem-typeprof · almalinux 9 0.15.2-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygem-typeprof · ol 10 0:0.21.9-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygems · RHEL 9 0:4.0.20-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygems · almalinux 9 3.2.33-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygems · ol 10 0:3.5.22-16.el10_2 ELSA-2026-96235 Nov 10, 2026
rubygems-devel · RHEL 9 0:4.0.20-36.module+el9.8.0+25290+d0128763 RHSA-2026:96120 Nov 10, 2026
rubygems-devel · almalinux 9 3.2.33-170.el9_8 ALSA-2026:96067 Nov 10, 2026
rubygems-devel · ol 10 0:3.5.22-16.el10_2 ELSA-2026-96235 Nov 10, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.