[CLSA-2026:1792869581] Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229
Type:
security
Severity:
Important
Release date:
2026-10-24 19:23:13 UTC
Description:
* SECURITY UPDATE: out-of-bounds heap access from overflowed regexp repeat and null-check IDs - debian/patches/CVE-2026-110264.patch: reject a pattern once reg->num_repeat or reg->num_null_check passes the MemNumType (short int) the IDs are emitted as. Past 32767 the stored ID wraps negative and regexec.c indexes repeat_stk[] and reg->repeat_range[] with it; backport of upstream ruby/ruby 493d26dcdea (PR #16801, Ruby 3.3.13) - CVE-2026-110264 * SECURITY UPDATE: wrapped regexp jump offsets from an overflowed compiled program size - debian/patches/CVE-2026-93577.patch: compare the quantifier expansion limit by division so a nested bounded repeat cannot wrap the int product, and cap the compiled program at the size its RelAddrType offsets can address. Also keeps the OP_END size error from being overwritten by unset_addr_list_fix() when the pattern contains a subexp call, without which the cap is bypassable; backport of upstream ruby/ruby 7cfe8dc82f9 and cf35145fc46 (PR #19020) plus b9ceb36f218 (PR #19495), all in Ruby 3.3.13 - CVE-2026-93577 * SECURITY UPDATE: the same compiled program size overflow reached through the CI/CD regexp path - debian/patches/CVE-2026-93577.patch: same Onigmo bug and the same upstream fix as CVE-2026-93577; GitLab assigned a second identifier for the CI/CD entry point - CVE-2026-97229
CVEs fixed:
Updated packages:
  • alt-ruby26_2.6.10-22_amd64.deb
    sha:d4821e3e6f47c35e782eaf9299a0193f47b14a19
  • alt-ruby26-default-gems_2.6.10-22_amd64.deb
    sha:d56a45c09cad46629e8e780593c4941f0b9e1baa
  • alt-ruby26-devel_2.6.10-22_amd64.deb
    sha:59fbfc018af28f3adc6a15b66a6fa1b9044d9644
  • alt-ruby26-devel-doc_2.6.10-22_amd64.deb
    sha:938ff1ecaf00ab8a8e92cce6efc2a7407f1f8954
  • alt-ruby26-doc_2.6.10-22_amd64.deb
    sha:aa14791ad97e13e9894a5909bc8c95fb6fc4c612
  • alt-ruby26-libs_2.6.10-22_amd64.deb
    sha:f8a12e1255da648f3594d114ba96aa2612029f9d
  • alt-ruby26-rubygem-bigdecimal_1.4.1-22_amd64.deb
    sha:312a292bee7fa442c4bebd91333fb1a1daa43ed7
  • alt-ruby26-rubygem-did-you-mean_1.3.0-22_amd64.deb
    sha:678d31cfff90350ddea11f1e3d8c93b3eb0e346a
  • alt-ruby26-rubygem-io-console_0.4.7-22_amd64.deb
    sha:221044f295f72e53aa2723bc7cbf870722e0d172
  • alt-ruby26-rubygem-json_2.1.0-22_amd64.deb
    sha:ed9e7c2fbd1a8422110cb384dfeb815d78a2c783
  • alt-ruby26-rubygem-minitest_5.11.3-22_amd64.deb
    sha:2b3e5261ff1e4c14e24beb7d0969e0df4faee9ae
  • alt-ruby26-rubygem-net-telnet_0.2.0-22_amd64.deb
    sha:d3c090de5b1e87d27494d73693e33f88669a6704
  • alt-ruby26-rubygem-openssl_2.1.2-22_amd64.deb
    sha:a261b767e2bd5624452d740c09219a322dc9be2b
  • alt-ruby26-rubygem-power-assert_1.1.3-22_amd64.deb
    sha:9bb82b0ee3ea61ad6c5dbfc4d68cd90e764b334b
  • alt-ruby26-rubygem-psych_3.1.0-22_amd64.deb
    sha:d38bc1d18ccb9a5fb7fff2bcdee9bb7cea039d27
  • alt-ruby26-rubygem-rake_12.3.3-22_amd64.deb
    sha:40e531e0c3d3a7bb1d239f56020dd596dae18c67
  • alt-ruby26-rubygem-rdoc_6.1.2.1-22_amd64.deb
    sha:cd2f14d616e0c03616322198c64afdcf8127d114
  • alt-ruby26-rubygem-test-unit_3.2.9-22_amd64.deb
    sha:bc93d586a2f2907a71510b820fd74f7567a39d52
  • alt-ruby26-rubygem-xmlrpc_0.3.0-22_amd64.deb
    sha:c8340e02e41a4f60cd8cc7a766ab5b10af11c2d2
  • alt-ruby26-rubygems_3.0.3.1-22_amd64.deb
    sha:e11df02b491f59880c3f47ad11bddf7da89be194
  • alt-ruby26-rubygems-devel_3.0.3.1-22_amd64.deb
    sha:1362e3e83f441430b04483b798f1f339e142e84e
  • alt-ruby26_2.6.10-22_arm64.deb
    sha:362e35b0f315676bd6ed8dbe86ebf05beb57377f
  • alt-ruby26-default-gems_2.6.10-22_arm64.deb
    sha:f42eb7f088496f8836bd56d4525babbbbb7dfabd
  • alt-ruby26-devel_2.6.10-22_arm64.deb
    sha:1ea1301b78381b18ee95aa55c6daf38b5d33a1d0
  • alt-ruby26-devel-doc_2.6.10-22_arm64.deb
    sha:4644142d0c78f49131f8681915bab79e5e1b86e0
  • alt-ruby26-doc_2.6.10-22_arm64.deb
    sha:7055bf3d8a1caa9d0b215e32a0cd7aca83c1ebd9
  • alt-ruby26-libs_2.6.10-22_arm64.deb
    sha:ec42bddc9958e594bce0a70c17b487a3e859e3f5
  • alt-ruby26-rubygem-bigdecimal_1.4.1-22_arm64.deb
    sha:8624c60162fac1427f56bce80547d9e3faab78e2
  • alt-ruby26-rubygem-did-you-mean_1.3.0-22_arm64.deb
    sha:2a9afb6dd4aa54083871955259b4cef8953f1d70
  • alt-ruby26-rubygem-io-console_0.4.7-22_arm64.deb
    sha:cd44f968acd243d252859db3f0ae188f03d32307
  • alt-ruby26-rubygem-json_2.1.0-22_arm64.deb
    sha:d5e44c631c0e90a966ba9b381ff6b78b9a60d26e
  • alt-ruby26-rubygem-minitest_5.11.3-22_arm64.deb
    sha:8e2a2786752e84754d8b801c1ea25706a530a546
  • alt-ruby26-rubygem-net-telnet_0.2.0-22_arm64.deb
    sha:2fd6d5712bd03f00e3e60df4c2d5f8b3d404fbb9
  • alt-ruby26-rubygem-openssl_2.1.2-22_arm64.deb
    sha:dbb055b9216faf1b803758321b11d25344221d4a
  • alt-ruby26-rubygem-power-assert_1.1.3-22_arm64.deb
    sha:c6b7aa56134a71285ec4476084321961f0c8d4e7
  • alt-ruby26-rubygem-psych_3.1.0-22_arm64.deb
    sha:0d8a9841681d0f44b12607427efe4edc12eafcdd
  • alt-ruby26-rubygem-rake_12.3.3-22_arm64.deb
    sha:529e319435c4c81ea2b55bc45b328971e4604747
  • alt-ruby26-rubygem-rdoc_6.1.2.1-22_arm64.deb
    sha:0503204767046ba52ffe832ea970bd72c500658e
  • alt-ruby26-rubygem-test-unit_3.2.9-22_arm64.deb
    sha:a16ac53423414f72c0829d46f0df5c4b91ce0989
  • alt-ruby26-rubygem-xmlrpc_0.3.0-22_arm64.deb
    sha:3391bd08a793d0fc55fe647a0fea0c709af6e209
  • alt-ruby26-rubygems_3.0.3.1-22_arm64.deb
    sha:b699000b90eb89cdbf100a2bf67c21a69a3de1f8
  • alt-ruby26-rubygems-devel_3.0.3.1-22_arm64.deb
    sha:902696686001faa5fe252af4bbb6f68d9e412753
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.