ALAS2023-2026-3400

References: CVE-2026-110264  CVE-2026-82455  CVE-2026-93577  CVE-2026-97229 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. (CVE-2026-110264)

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory. (CVE-2026-82455)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration. (CVE-2026-93577)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. (CVE-2026-97229)

Issue Correction:
Run dnf update ruby4.0 --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3400 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    ruby4.0-debuginfo-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-devel-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-bundled-gems-debuginfo-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-libs-debuginfo-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-racc-1.8.1-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-json-2.18.0-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-rbs-debuginfo-3.10.0-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-io-console-debuginfo-0.8.2-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-racc-debuginfo-1.8.1-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-bigdecimal-debuginfo-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-bundled-gems-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-rbs-3.10.0-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-psych-5.3.1-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-bigdecimal-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-io-console-0.8.2-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-json-debuginfo-2.18.0-32.amzn2023.0.5.aarch64
    ruby4.0-debugsource-4.0.1-32.amzn2023.0.5.aarch64
    ruby4.0-rubygem-psych-debuginfo-5.3.1-32.amzn2023.0.5.aarch64
    ruby4.0-libs-4.0.1-32.amzn2023.0.5.aarch64

noarch:
    ruby4.0-rubygem-bundler-4.0.3-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-rss-0.3.2-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-typeprof-0.31.1-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-rake-13.3.1-32.amzn2023.0.5.noarch
    ruby4.0-rubygems-devel-4.0.3-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-rdoc-7.0.3-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-power_assert-3.0.1-32.amzn2023.0.5.noarch
    ruby4.0-rubygems-4.0.3-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-test-unit-3.7.5-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-minitest-6.0.0-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-irb-1.16.0-32.amzn2023.0.5.noarch
    ruby4.0-default-gems-4.0.1-32.amzn2023.0.5.noarch
    ruby4.0-rubygem-rexml-3.4.4-32.amzn2023.0.5.noarch
    ruby4.0-doc-4.0.1-32.amzn2023.0.5.noarch

src:
    ruby4.0-4.0.1-32.amzn2023.0.5.src

x86_64:
    ruby4.0-rubygem-json-debuginfo-2.18.0-32.amzn2023.0.5.x86_64
    ruby4.0-libs-debuginfo-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-debugsource-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-racc-1.8.1-32.amzn2023.0.5.x86_64
    ruby4.0-bundled-gems-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-libs-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-io-console-0.8.2-32.amzn2023.0.5.x86_64
    ruby4.0-bundled-gems-debuginfo-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-json-2.18.0-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-bigdecimal-debuginfo-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-psych-debuginfo-5.3.1-32.amzn2023.0.5.x86_64
    ruby4.0-devel-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-racc-debuginfo-1.8.1-32.amzn2023.0.5.x86_64
    ruby4.0-debuginfo-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-rbs-debuginfo-3.10.0-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-io-console-debuginfo-0.8.2-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-psych-5.3.1-32.amzn2023.0.5.x86_64
    ruby4.0-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-bigdecimal-4.0.1-32.amzn2023.0.5.x86_64
    ruby4.0-rubygem-rbs-3.10.0-32.amzn2023.0.5.x86_64