[CLSA-2026:1792868114] Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229
Type:
security
Severity:
Important
Release date:
2026-10-24 18:56:09 UTC
Description:
* SECURITY UPDATE: out-of-bounds heap access from overflowed regexp repeat and null-check IDs - debian/patches/CVE-2026-110264.patch: reject a pattern once reg->num_repeat or reg->num_null_check passes the MemNumType (short int) the IDs are emitted as. Past 32767 the stored ID wraps negative and regexec.c indexes repeat_stk[] and reg->repeat_range[] with it; backport of upstream ruby/ruby 493d26dcdea (PR #16801, Ruby 3.3.13) - CVE-2026-110264 * SECURITY UPDATE: wrapped regexp jump offsets from an overflowed compiled program size - debian/patches/CVE-2026-93577.patch: compare the quantifier expansion limit by division so a nested bounded repeat cannot wrap the int product, and cap the compiled program at the size its RelAddrType offsets can address. Also keeps the OP_END size error from being overwritten by unset_addr_list_fix() when the pattern contains a subexp call, without which the cap is bypassable; backport of upstream ruby/ruby 7cfe8dc82f9 and cf35145fc46 (PR #19020) plus b9ceb36f218 (PR #19495), all in Ruby 3.3.13 - CVE-2026-93577 * SECURITY UPDATE: the same compiled program size overflow reached through the CI/CD regexp path - debian/patches/CVE-2026-93577.patch: same Onigmo bug and the same upstream fix as CVE-2026-93577; GitLab assigned a second identifier for the CI/CD entry point - CVE-2026-97229
CVEs fixed:
Updated packages:
  • alt-ruby26_2.6.10-22_amd64.deb
    sha:092825f5afa17df31ea0fbaf7bf4e72bb560ca6f
  • alt-ruby26-default-gems_2.6.10-22_amd64.deb
    sha:d56a45c09cad46629e8e780593c4941f0b9e1baa
  • alt-ruby26-devel_2.6.10-22_amd64.deb
    sha:173a698bc4d69015293f5ca1f954d6d2151c3374
  • alt-ruby26-devel-doc_2.6.10-22_amd64.deb
    sha:938ff1ecaf00ab8a8e92cce6efc2a7407f1f8954
  • alt-ruby26-doc_2.6.10-22_amd64.deb
    sha:aa14791ad97e13e9894a5909bc8c95fb6fc4c612
  • alt-ruby26-libs_2.6.10-22_amd64.deb
    sha:8ee8f1d469e86a936cd559f576514f4a79932896
  • alt-ruby26-rubygem-bigdecimal_1.4.1-22_amd64.deb
    sha:ddf5a1f59db3fb5cef5fea7fd6bf365008e80fef
  • alt-ruby26-rubygem-did-you-mean_1.3.0-22_amd64.deb
    sha:678d31cfff90350ddea11f1e3d8c93b3eb0e346a
  • alt-ruby26-rubygem-io-console_0.4.7-22_amd64.deb
    sha:53adf843fdbd3aa975559e6941cabcd6e68b3223
  • alt-ruby26-rubygem-json_2.1.0-22_amd64.deb
    sha:662c8120d62ad485482569b30a3b8f2531aeb911
  • alt-ruby26-rubygem-minitest_5.11.3-22_amd64.deb
    sha:2b3e5261ff1e4c14e24beb7d0969e0df4faee9ae
  • alt-ruby26-rubygem-net-telnet_0.2.0-22_amd64.deb
    sha:d3c090de5b1e87d27494d73693e33f88669a6704
  • alt-ruby26-rubygem-openssl_2.1.2-22_amd64.deb
    sha:0d1bf4eed2b528bc085ad92011c773a7a4645b9a
  • alt-ruby26-rubygem-power-assert_1.1.3-22_amd64.deb
    sha:9bb82b0ee3ea61ad6c5dbfc4d68cd90e764b334b
  • alt-ruby26-rubygem-psych_3.1.0-22_amd64.deb
    sha:05aec825c82ae0b3958f274257ef6b197060ac2e
  • alt-ruby26-rubygem-rake_12.3.3-22_amd64.deb
    sha:40e531e0c3d3a7bb1d239f56020dd596dae18c67
  • alt-ruby26-rubygem-rdoc_6.1.2.1-22_amd64.deb
    sha:cd2f14d616e0c03616322198c64afdcf8127d114
  • alt-ruby26-rubygem-test-unit_3.2.9-22_amd64.deb
    sha:bc93d586a2f2907a71510b820fd74f7567a39d52
  • alt-ruby26-rubygem-xmlrpc_0.3.0-22_amd64.deb
    sha:c8340e02e41a4f60cd8cc7a766ab5b10af11c2d2
  • alt-ruby26-rubygems_3.0.3.1-22_amd64.deb
    sha:e11df02b491f59880c3f47ad11bddf7da89be194
  • alt-ruby26-rubygems-devel_3.0.3.1-22_amd64.deb
    sha:1362e3e83f441430b04483b798f1f339e142e84e
  • alt-ruby26_2.6.10-22_arm64.deb
    sha:ac6e02a5cd57f533ccf069fff84254cc0e2d7f44
  • alt-ruby26-default-gems_2.6.10-22_arm64.deb
    sha:f42eb7f088496f8836bd56d4525babbbbb7dfabd
  • alt-ruby26-devel_2.6.10-22_arm64.deb
    sha:bae0f8e27966d286fabd2037f7dc55d59321e50e
  • alt-ruby26-devel-doc_2.6.10-22_arm64.deb
    sha:4644142d0c78f49131f8681915bab79e5e1b86e0
  • alt-ruby26-doc_2.6.10-22_arm64.deb
    sha:7055bf3d8a1caa9d0b215e32a0cd7aca83c1ebd9
  • alt-ruby26-libs_2.6.10-22_arm64.deb
    sha:eab28affa87b4bcde798d07e482f5913532e4cbe
  • alt-ruby26-rubygem-bigdecimal_1.4.1-22_arm64.deb
    sha:389c185d5ac41ee769a5b5c3df87bfd8be946790
  • alt-ruby26-rubygem-did-you-mean_1.3.0-22_arm64.deb
    sha:2a9afb6dd4aa54083871955259b4cef8953f1d70
  • alt-ruby26-rubygem-io-console_0.4.7-22_arm64.deb
    sha:0087d43f97965bd50a95b3abfd028e8e138bb5c1
  • alt-ruby26-rubygem-json_2.1.0-22_arm64.deb
    sha:f8a7521ca408c9db9c5d89c1a7c7c35615b8b930
  • alt-ruby26-rubygem-minitest_5.11.3-22_arm64.deb
    sha:8e2a2786752e84754d8b801c1ea25706a530a546
  • alt-ruby26-rubygem-net-telnet_0.2.0-22_arm64.deb
    sha:2fd6d5712bd03f00e3e60df4c2d5f8b3d404fbb9
  • alt-ruby26-rubygem-openssl_2.1.2-22_arm64.deb
    sha:575c1805b0f15af8b61d8b83973218c757733331
  • alt-ruby26-rubygem-power-assert_1.1.3-22_arm64.deb
    sha:c6b7aa56134a71285ec4476084321961f0c8d4e7
  • alt-ruby26-rubygem-psych_3.1.0-22_arm64.deb
    sha:7ca06e8570a3f0a13c22a77238e6f56c6728599e
  • alt-ruby26-rubygem-rake_12.3.3-22_arm64.deb
    sha:529e319435c4c81ea2b55bc45b328971e4604747
  • alt-ruby26-rubygem-rdoc_6.1.2.1-22_arm64.deb
    sha:0503204767046ba52ffe832ea970bd72c500658e
  • alt-ruby26-rubygem-test-unit_3.2.9-22_arm64.deb
    sha:a16ac53423414f72c0829d46f0df5c4b91ce0989
  • alt-ruby26-rubygem-xmlrpc_0.3.0-22_arm64.deb
    sha:3391bd08a793d0fc55fe647a0fea0c709af6e209
  • alt-ruby26-rubygems_3.0.3.1-22_arm64.deb
    sha:b699000b90eb89cdbf100a2bf67c21a69a3de1f8
  • alt-ruby26-rubygems-devel_3.0.3.1-22_arm64.deb
    sha:902696686001faa5fe252af4bbb6f68d9e412753
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.