- CVE-2026-110264: Onigmo wrote unbounded repeat and null-check ids through the signed 16-bit MemNumType, so a pattern with over 32767 bounded repeats compiled with wrapped ids and segfaulted at match time. Both counters are now range-checked and the compile raises RegexpError. - CVE-2026-93577, CVE-2026-97229: the compiler's program-size accounting overflowed int, so a nested bounded repeat passed the expansion limit and an over-sized program wrapped its own jump offsets. The check now divides instead of multiplying and add_opcode() refuses an over-cap program. One upstream fix, two assigned ids. - Both are reachable only by compiling a regexp from attacker-controlled text (Regexp.new / union / compile, /#{}/); Regexp.timeout does not protect.