Issue #22464 has been updated by byroot (Jean Boussier). Status changed from Open to Closed Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: REQUIRED, 3.4: DONE, 4.0: REQUIRED 3.4 was backported a few hours ago. I just opened a backport PR for 4.0 at https://github.com/ruby/ruby/pull/19486 (closing because that's the process for backports) ---------------------------------------- Bug #22464: Backport #16801 (overflowed repeat/null-check IDs in Onigmo) to 4.0 and 3.4; missing from 4.0.8 despite its release notes https://bugs.ruby-lang.org/issues/22464#change-119632 * Author: stephankaag (Stephan Kaag) * Status: Closed * ruby -v: ruby 4.0.8 (2026-10-22 revision 60c3d71bfb) +PRISM [arm64-darwin27] * Backport: 3.3: REQUIRED, 3.4: DONE, 4.0: REQUIRED ---------------------------------------- PR https://github.com/ruby/ruby/pull/16801 (commit 493d26dcde, merged 2026-04-29) rejects a regexp with more than 32767 counted repeats. Without it the repeat ID, a signed 16-bit value, wraps and the matcher writes out of bounds. GitLab shipped this fix on 2026-10-21 as part of CVE-2026-110264 (CVSS 10.0) for its bundled Ruby 3.3, 3.4 and 4.0. The fix is on master only. Ruby 4.0.8 (released 2026-10-22) does not contain it: * `include/ruby/onigmo.h` at v4.0.8 has `ONIGERR_TOO_BIG_COMPILED_PROGRAM` (-226) but not `ONIGERR_TOO_MANY_RANGE_REPEAT` (-224) or `ONIGERR_TOO_MANY_NULL_CHECK` (-225). * `regcomp.c` and `regerror.c` at v4.0.8 have no reference to these errors. * On a build of v4.0.8, `Regexp.new("(?:foobar){0,100}" * 40000)` compiles without error. With #16801 it raises RegexpError. The auto-generated GitHub release notes of v4.0.8 list the PR, which suggests the backport was intended. Please backport 493d26dcde to ruby_4_0 and ruby_3_4. The backport of the program size fixes (#19025) is already on both branches and in 4.0.8. -- https://bugs.ruby-lang.org/