Bug #22464: Backport #16801 (overflowed repeat/null-check IDs in Onigmo) to 4.0 and 3.4; missing from 4.0.8 despite its release notes

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 4.0.8 (2026-10-22 revision 60c3d71bfb) +PRISM [arm64-darwin27]
• Backport: 3.3: REQUIRED, 3.4: DONE, 4.0: DONE

[stephankaag (Stephan Kaag)]

PR https://github.com/ruby/ruby/pull/16801 (commit 493d26dcde, merged 2026-04-29) rejects a regexp with more than 32767 counted repeats. Without it the repeat ID, a signed 16-bit value, wraps and the matcher writes out of bounds. GitLab shipped this fix on 2026-10-21 as part of CVE-2026-110264 (CVSS 10.0) for its bundled Ruby 3.3, 3.4 and 4.0.

The fix is on master only. Ruby 4.0.8 (released 2026-10-22) does not contain it:

• include/ruby/onigmo.h at v4.0.8 has ONIGERR_TOO_BIG_COMPILED_PROGRAM (-226) but not ONIGERR_TOO_MANY_RANGE_REPEAT (-224) or ONIGERR_TOO_MANY_NULL_CHECK (-225).
• regcomp.c and regerror.c at v4.0.8 have no reference to these errors.
• On a build of v4.0.8, Regexp.new("(?:foobar){0,100}" * 40000) compiles without error. With #16801 it raises RegexpError.

The auto-generated GitHub release notes of v4.0.8 list the PR, which suggests the backport was intended.

Please backport 493d26dcde to ruby_4_0 and ruby_3_4. The backport of the program size fixes (#19025) is already on both branches and in 4.0.8.

[byroot (Jean Boussier)]

• Status changed from Open to Closed
• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: REQUIRED, 3.4: DONE, 4.0: REQUIRED

3.4 was backported a few hours ago.

I just opened a backport PR for 4.0 at https://github.com/ruby/ruby/pull/19486

(closing because that's the process for backports)

[byroot (Jean Boussier)]

• Backport changed from 3.3: REQUIRED, 3.4: DONE, 4.0: REQUIRED to 3.3: REQUIRED, 3.4: DONE, 4.0: DONE