Local Ruby-based detector for CVE-2026-110264 — the Onigmo (Ruby regex engine) repeat-ID integer overflow behind GitLab's October 21, 2026 critical patch (unauthenticated RCE, affects self-managed GitLab versions since 7.0).
The vulnerability: patterns with more than 32,767 range-repeats overflow Onigmo's signed-16-bit repeat IDs — negative index — out-of-bounds write at match time (crash reproduced on ruby 3.4.11 — the runtime GitLab bundles).
Patched builds raise RegexpError: too many range repeat at compile.
This check compiles the upstream regression fixture and reports which side you're on.
ruby onigmo-check.rb
# inside a GitLab Omnibus container:
docker exec -it gitlab /opt/gitlab/embedded/bin/ruby /path/to/onigmo-check.rbExit codes: 0 = patched · 1 = vulnerable engine · 2 = other error.
| Ruby | Result | Exit |
|---|---|---|
| 3.4.11 (GitLab-bundled line) | compiles, segfaults on match | 1 |
| 4.0.x | compiles (fix only on master) | 1 |
| patched master behavior | RegexpError at compile | 0 |
Full lab writeup: LAB-VERIFICATION.md
MIT.