> We have not requested CVE identifiers in Ruby for these fixes, at least for now.
> Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for CVE-2022-28738, where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for CVE-2024-27282.
https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-fo...
> We have not requested CVE identifiers in Ruby for these fixes, at least for now.
> Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for CVE-2022-28738, where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for CVE-2024-27282.