← Back to Security Research Portal (ccsimplyspolit.github.io)

CVD-2026-RUBY-001: Coordinated Vulnerability Disclosure Record (ruby/ruby)

[UNDER COORDINATED DISCLOSURE EMBARGO • HACKERONE REPORT #4161393]
This record confirms researcher ownership for Coordinated Vulnerability Disclosure CVD-2026-RUBY-001 submitted privately to the Ruby Security Team via HackerOne (#4161393). In accordance with Coordinated Vulnerability Disclosure (CVD) policy, full technical details, reproduction steps, and the proposed C patch in regcomp.c are restricted to the private HackerOne report thread until upstream triage and remediation are complete.

0x00 // Disclosure Verification Metadata

{
  "record_id": "CVD-2026-RUBY-001",
  "channel": "HackerOne (ruby IBB / Ruby Security Team)",
  "hackerone_report_id": "4161393",
  "repository": "ruby/ruby",
  "component": "regcomp.c (Onigmo Regexp Compiler)",
  "cwe": "CWE-1333 / CWE-407",
  "reporter": {
    "name": "Serhii Shunko",
    "github": "https://github.com/ccsimplyspolit",
    "hackerone": "https://hackerone.com/sshunko",
    "portal": "https://ccsimplyspolit.github.io/"
  },
  "status": "Under Coordinated Disclosure Embargo"
}