Repository navigation
Security/ruby 3.2 regexp fixes - #321
Merged
Sharpie merged 3 commits intoOct 28, 2026
Merged
Conversation
ehelms
force-pushed
the
security/ruby-3.2-regexp-fixes
branch
from
October 27, 2026 18:46
d35ae2f to
630a9a6
Compare
Sharpie
approved these changes
Oct 28, 2026
Sharpie
left a comment
Sharpie
left a comment
Member
There was a problem hiding this comment.
I was looking into this myself over the weekend and got as far as extracting the patch series, but stopped before addressing some the failing hunks.
This looks like the correct set of 6 patches, thanks for doing this extraction and submitting a PR!
Member
|
@ehelms In order to merge this, we'll need each commit to be signed by a SSH or GPG key registered to your GitHub account. |
ehelms
force-pushed
the
security/ruby-3.2-regexp-fixes
branch
from
October 28, 2026 10:55
630a9a6 to
c58f74f
Compare
Contributor
Author
|
Updated with signatures |
ehelms
force-pushed
the
security/ruby-3.2-regexp-fixes
branch
from
October 28, 2026 12:15
c58f74f to
75e72c0
Compare
Member
|
@ehelms looks like merging is still blocked due to no signatures. Looking at the PR commits locally, I get a $ git fetch upstream pull/321/head
From https://github.com/OpenVoxProject/puppet-runtime
* branch refs/pull/321/head -> FETCH_HEAD
$ git log upstream/main..FETCH_HEAD --format="Commit: %h | Signature: %G?"
Commit: 75e72c0ebf | Signature: N
Commit: 956974f697 | Signature: N
Commit: 296f8af314 | Signature: N |
Ruby 3.2.11 can double-free the parse tree when parsing fails after an alternation. Backport the Ruby 3.3 ownership fix and its follow-up for an otherwise leaked partial branch. Include regression coverage for GitLab CVE-2026-89078 and Ruby bug #22384. Signed-off-by: Eric D. Helms <[email protected]>
Large regexps can overflow the IDs used for repeats and null checks during compilation. Backport Ruby 3.3 bounds checks and regression tests to address GitLab CVE-2026-110264 in Ruby 3.2. Signed-off-by: Eric D. Helms <[email protected]>
Ruby 3.2.11 can overflow arithmetic while expanding nested repeats or emitting a program larger than its offset type. Backport Ruby 3.3 limits and preserve the size error for subexpression calls. This addresses GitLab CVE-2026-93577 and CVE-2026-97229. Keep all six backports in dependency order for agent-runtime-8.x. Signed-off-by: Eric D. Helms <[email protected]>
ehelms
force-pushed
the
security/ruby-3.2-regexp-fixes
branch
from
October 28, 2026 14:12
75e72c0 to
3ed1bad
Compare
Contributor
Author
|
@Sharpie it had been showing them in my local git log as signed, I tried again and now I see them as Verified in the UI |
Member
|
Looks good! Thanks again for putting this patchset together! We'll run it through acceptance tests this week and look towards making a release of |
Contributor
Author
|
Thank you! |
3 of 8 tasks
Sharpie
added a commit
to Sharpie/openvox-sbom-tools
that referenced
this pull request
Oct 29, 2026
The 2026.10.28.1 release of `agent-runtime-8x` contains backported patches for flaws in the Ruby 3.2 regex library and OpenSSL 3.0.22: - OpenVoxProject/puppet-runtime#321 - OpenVoxProject/puppet-runtime#322 This commit adds the associated CVE IDs to the list of special cases used for reporting fixes. Signed-off-by: Charlie Sharpsteen <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backport Ruby 3.3.13's regexp compilation fixes to the Ruby 3.2.11 shipped by
agent-runtime-8.x. Ruby 3.2 lacks the fixes for the underlying bugs associated with GitLab CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264.This changes the native Ruby runtime used by OpenVox agents; OpenVox Server's separate JRuby runtime is not changed.
I applied these patches to the ruby_3_2 branch in the ruby repository, and run all tests there. I have not attempted any openvox-agent builds with this change (I don't know how to do that).
Test plan
patch -p1 --fuzz=0, without rejects (verified locally).make test-all TESTS=../ruby/test/ruby/test_regexp.rbfrom a sibling build directory. The requester reports that all tests passed.agent-runtime-8.xwith Vanagon on supported platforms to verify packaging and platform-specific patch combinations (not run locally).