Diving into Ruby 3 ReDoS Defense: Design Trade-offs, Rails Integration, and the Future of Regexp

"Left on read... every time I suggest a version upgrade."

Ruby 3.2 introduced significant improvements to Regexp security and performance. With Ruby 4 recently released and Ruby 3.2 now officially reaching EOL, the community’s approach to ReDoS (Regular Expression Denial of Service) has gradually extended from “how do we write safe Regex” to “how can the runtime itself help reduce risk for developers.”

However, the CVE-2026-1388 incident in GitLab and CVE-2026-33169 in Active Support in early 2026 once again remind us that in real-world web applications, Regexp can still become an unexpected source of performance and security issues.

This talk continues the discussion from the RubyJam 2026.03 Meetup around Ruby Feature #17837 and #19104, and extends it with the latest developments in 2026:

1. Case breakdown: Analyzing two ReDoS-related CVEs in 2026, and examining which Regexp patterns can still introduce risk under existing mitigation mechanisms.
2. Rails in practice: How to integrate Regexp Timeout into Rails applications, and what practical pitfalls to watch out for.
3. From ReDoS to Timing Attacks: Following up on questions from the RubyJam Meetup, exploring the other side of algorithmic complexity attacks, and how Ruby ecosystems implement Constant Time Comparison.
4. The latest direction of Ruby Regexp: First-hand insights from RubyKaigi 2026, looking into the ongoing progress of introducing JIT into Regexp and what it may imply for security considerations going forward.