this is a really bad look in 2026 imo

https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-fo...

> We have not requested CVE identifiers in Ruby for these fixes, at least for now.

> Ruby has generally considered it unsafe to compile and use a regular expression created from untrusted input. We stated this in the advisory for CVE-2022-28738, where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment. We did the same for CVE-2024-27282.

▲

couchand 4 hours ago | parent [-]

It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

Despite what anyone would try to sell you, a regular expression is a programming language. It's Always A Bad Idea (TM) to compile untrusted input into any kind of programming language. Don't string concatenate SQL queries, eval is evil, it's all the same idea.

	▲	Blackthorn 2 hours ago \| parent \| next [-]
		A regex might be a programming language, a proper regular expression (which there are libraries for, like Google RE2) is just a regular language and I don't think you can even charitably call that a programming language.
	▲	milkshakes 22 minutes ago \| parent \| prev [-]
		> It's a Bad Idea (TM) to compile a regular expression from an untrusted input. i agree with you! nevertheless, > where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment not sure what sort of comprehensive assessment is still called for at this point?