{
  "title": "CVE-2026-110264 defensive remediation pilot",
  "verifiedAt": "2026-10-31T18:11:51.398461+00:00",
  "verificationPassed": true,
  "scope": "Compiled the minimal upstream Ruby interpreter from official Ruby 3.4.11 and 3.4.12 source releases. Ran two compiler regression fixtures from the patched upstream test suite and one normal-functionality control. This was not a full GitLab application deployment or an RCE exploit test.",
  "environment": {
    "provider": "Vercel Sandbox",
    "os": "Linux-6.18.56-x86_64-with-glibc2.43",
    "region": "sfo1",
    "vcpus": 2,
    "memoryMiB": 4096,
    "publicRoutes": [],
    "persistent": false,
    "sourceAndBuildLocation": "remote only",
    "networkDuringBuildAndTests": "deny-all, with DNS blocking verified",
    "setupNetwork": "restricted to official package and source hosts",
    "maximumSessionMinutes": 60
  },
  "safety": {
    "productionCredentialsSupplied": false,
    "productionDataSupplied": false,
    "exploitPayloadCreated": false,
    "coreDumps": "disabled",
    "testCpuLimitSeconds": 10,
    "testWallLimitSeconds": 15,
    "testAddressSpaceLimitBytes": 1073741824
  },
  "sourceReleases": [
    {
      "version": "3.4.11",
      "url": "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.11.tar.xz",
      "sha256": "f79c6e789ce4f30f77c88a40b23b93e2547c512a843dc17db27ab1f5cc66f4e4",
      "bytes": 16712500
    },
    {
      "version": "3.4.12",
      "url": "https://cache.ruby-lang.org/pub/ruby/3.4/ruby-3.4.12.tar.xz",
      "sha256": "db6c147940d7ad0b706823d42c8e6713c36dec70a1f83f635f1d3a7f0599ec90",
      "bytes": 16732860
    }
  ],
  "fixtureSource": "Ruby 3.4.12 test/ruby/test_regexp.rb",
  "fixtureFileSha256": "7367a22de49dd76d9ce6874b8cfb8f50d7ddb2a9d7d15c1832b85cb942dbd5c5",
  "testResults": [
    {
      "exit_code": 0,
      "stdout": "",
      "stderr": "",
      "seconds": 0.023,
      "version": "3.4.11",
      "test": "normal_regexp_control"
    },
    {
      "exit_code": 0,
      "stdout": "ACCEPTED\n",
      "stderr": "",
      "seconds": 0.192,
      "version": "3.4.11",
      "test": "test_too_many_range_repeat",
      "upstream_fixture_repetitions": 100000
    },
    {
      "exit_code": 0,
      "stdout": "ACCEPTED\n",
      "stderr": "",
      "seconds": 0.52,
      "version": "3.4.11",
      "test": "test_too_many_null_check",
      "upstream_fixture_repetitions": 100000
    },
    {
      "exit_code": 0,
      "stdout": "",
      "stderr": "",
      "seconds": 0.01,
      "version": "3.4.12",
      "test": "normal_regexp_control"
    },
    {
      "exit_code": 20,
      "stdout": "REJECTED: too many range repeat\n",
      "stderr": "",
      "seconds": 0.122,
      "version": "3.4.12",
      "test": "test_too_many_range_repeat",
      "upstream_fixture_repetitions": 100000
    },
    {
      "exit_code": 20,
      "stdout": "REJECTED: too many null check\n",
      "stderr": "",
      "seconds": 0.241,
      "version": "3.4.12",
      "test": "test_too_many_null_check",
      "upstream_fixture_repetitions": 100000
    }
  ],
  "buildResults": [
    {
      "version": "3.4.11",
      "stage": "configure",
      "exit_code": 0,
      "seconds": 39.17
    },
    {
      "version": "3.4.11",
      "stage": "build",
      "exit_code": 0,
      "seconds": 123.94
    },
    {
      "version": "3.4.12",
      "stage": "configure",
      "exit_code": 0,
      "seconds": 39.37
    },
    {
      "version": "3.4.12",
      "stage": "build",
      "exit_code": 0,
      "seconds": 130.26
    }
  ],
  "buildCommands": [
    "./configure --disable-install-doc --disable-shared --disable-yjit --disable-rjit",
    "make -j2 miniruby"
  ],
  "compiler": "gcc (Ubuntu 15.2.0-16ubuntu1) 15.2.0",
  "binarySha256": {
    "3.4.11": "5324f311fc58545f45c099a1f817414e7b6bd54c6367fbcfe734562fb8b01269",
    "3.4.12": "574a75e0a80948b2ac7cd8fcef36de816b54d190f33715008f68de7d33423b79"
  },
  "sources": [
    "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/",
    "https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/",
    "https://github.com/ruby/ruby/pull/16801/files",
    "https://www.ruby-lang.org/en/news/2026/09/23/ruby-3-4-11-released/",
    "https://www.ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-released/"
  ],
  "limitations": [
    "A normal control plus two targeted compiler cases is not a comprehensive security assessment.",
    "The GitLab package upgrade, deployment migration, and service restart were not executed in this pilot.",
    "A patched upstream Ruby version is not a substitute for checking GitLab vendor packages and backports."
  ],
  "cleanup": {
    "status": "verified stopped",
    "persistent": false,
    "publicRoutes": [],
    "sessionStoppedAt": "2026-10-31T18:12:08.671Z",
    "sessionDurationSeconds": 678.532,
    "networkPolicyAtStop": "deny-all"
  }
}