[CLSA-2026:1793103248] Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229
Type:
security
Severity:
Critical
Release date:
2026-10-27 12:14:22 UTC
Description:
* SECURITY UPDATE: Onigmo wrote repeat and null-check ids into the compiled program through a signed 16-bit type without checking them - debian/patches/CVE-2026-110264.patch: range-check reg->num_repeat and reg->num_null_check so a pattern with more than 32767 bounded repeats or null checks raises RegexpError instead of compiling with wrapped ids and segfaulting at match time; upstream ruby 63eda2681e (bug #16801) - CVE-2026-110264 * SECURITY UPDATE: integer overflow in the Onigmo compiler's program-size accounting - debian/patches/CVE-2026-93577.patch: compare against the quantifier expansion limit by division instead of multiplying into int, cap the emitted program at MAX_COMPILED_PROGRAM_SIZE, and stop that error being overwritten for patterns using subexp calls; upstream ruby fa98ef030a, b03e500193, f6496bca68 (bug #19020) - CVE-2026-93577 * SECURITY UPDATE: the same Onigmo program-size overflow under a second id - one upstream fix covers both ids, carried by the same patch - CVE-2026-97229
CVEs fixed:
Updated packages:
  • alt-ruby31_3.1.7-15_amd64.deb
    sha:1588f5f43d310ac1c38465f6d550d2bbb6ab217b
  • alt-ruby31-bundled-gems_3.1.7-15_amd64.deb
    sha:6b24763cc4c14efe787eae6b4c3e86467e1a0529
  • alt-ruby31-default-gems_3.1.7-15_amd64.deb
    sha:c933d769d1a5447490d83dfde90ce15d7d578f14
  • alt-ruby31-devel_3.1.7-15_amd64.deb
    sha:601ec753d5b1cf1078bb90cee061807e9183552a
  • alt-ruby31-doc_3.1.7-15_amd64.deb
    sha:0c7e73bf107b523c4d821f282893eb6fa041a22d
  • alt-ruby31-libs_3.1.7-15_amd64.deb
    sha:29d92fa40cbbf72e2242d0c21c8d33adce984bef
  • alt-ruby31-rubygem-bigdecimal_3.1.1-15_amd64.deb
    sha:137f2e682356603f95b7836e7a5723594feec4b5
  • alt-ruby31-rubygem-bundler_2.3.27-15_amd64.deb
    sha:4cf1c52939d0e8ba5ac8613d7aa6a672e876a1cb
  • alt-ruby31-rubygem-io-console_0.5.11-15_amd64.deb
    sha:ed2cb04858fd80ebbe40b9390609e453e973f244
  • alt-ruby31-rubygem-irb_1.4.1-15_amd64.deb
    sha:d9ae5300ffbe6740f534223c22a5a2d595d048f8
  • alt-ruby31-rubygem-json_2.6.1-15_amd64.deb
    sha:75bfc38dda50b2200819597ba37f6427f51b723a
  • alt-ruby31-rubygem-minitest_5.15.0-15_amd64.deb
    sha:062059a5b3f3e56c9cc6a4d1d28abe43a103a725
  • alt-ruby31-rubygem-power-assert_2.0.1-15_amd64.deb
    sha:e866d0a45bacc32378284f4e13430d6c2e5a294f
  • alt-ruby31-rubygem-psych_4.0.4-15_amd64.deb
    sha:36559d16cce3237d76e65058c2001432d8ddf8b0
  • alt-ruby31-rubygem-rake_13.0.6-15_amd64.deb
    sha:53b165d4a3db5852a315d0116fbf2bcd9f220d03
  • alt-ruby31-rubygem-rbs_2.7.0-15_amd64.deb
    sha:a40bb6e215f6516b950efd63ce4d690c339323cd
  • alt-ruby31-rubygem-rdoc_6.4.1.1-15_amd64.deb
    sha:cac1e6a721bb02b57567e8be99c876ffa36d8ecb
  • alt-ruby31-rubygem-rexml_3.3.9-15_amd64.deb
    sha:fafad1618bf3154524a7a0aaed7bc12a75276eab
  • alt-ruby31-rubygem-rss_0.3.1-15_amd64.deb
    sha:f130ddb296a1f69c9c57e2d538492d1953229c49
  • alt-ruby31-rubygem-test-unit_3.5.3-15_amd64.deb
    sha:1a47d61abf8224bf9942136578bec1dfbce85fe8
  • alt-ruby31-rubygem-typeprof_0.21.3-15_amd64.deb
    sha:44729e2b11ad93827c9d797a0082fdd7847d8d21
  • alt-ruby31-rubygems_3.3.27-15_amd64.deb
    sha:6ab6ebc9c3390e8f5f2dbeeb94c21a59f49536d9
  • alt-ruby31-rubygems-devel_3.3.27-15_amd64.deb
    sha:62d27c8111be1a8be461c6ea53ed8d35a9553191
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.