- CVE-2026-89078: double free in the Onigmo regexp parser - parse_subexp() built the alternation node in the caller's *top, so a regexp source whose second branch fails to parse (e.g. /|{1000000}/) made both parse_subexp() and onig_parse_tree() free the same node. Includes the required upstream follow-up for bug #22384, which also frees the half-built failed branch. - CVE-2026-110264: overflow of the Onigmo repeat and null-check IDs - the int counters reg->num_repeat and reg->num_null_check outgrow MemNumType (short), so past 32767 of either the ID emitted into the compiled program wrapped and aliased another construct's match state. Such patterns now raise RegexpError. - CVE-2026-93577, CVE-2026-97229: integer overflow in the size of a compiled Onigmo pattern - the quantifier expansion check multiplied two ints whose product wrapped, so repeats that should have been refused were unrolled, and a program grown past INT_MAX wrapped the offsets emitted into it. The expansion check now divides, and add_opcode() caps the program size. - All three are reachable only where a regexp is compiled from untrusted input (Regexp.new, Regexp.union, Regexp.compile, /#{input}/); Regexp.timeout does not bound them, because they happen while the pattern is compiled.