GitLab patches CVE-2026-110264, a maximum-severity flaw that could let an unauthenticated attacker run code on self-managed servers

TLDR

• GitLab patched CVE-2026-110264, a CVSS 10.0 flaw that could allow unauthenticated code execution, on 21 October.¹²
• It affects versions back to 7.0; fixes are in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13.¹²
• Self-managed installations must upgrade; GitLab.com is patched, and The Hacker News reports no sign of attacks.¹²

GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 of GitLab Community Edition and Enterprise Edition on 21 October, and strongly recommends that all self-managed installations upgrade immediately.¹ The critical fix is for CVE-2026-110264, which GitLab says could, under certain conditions, allow an unauthenticated user to execute arbitrary code on the server through an integer overflow when compiling a specially crafted regular expression.¹ GitLab rates it CVSS 10.0 and lists affected versions as all from 7.0 before 18.11.13, plus 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.¹ GitLab.com already runs the patched version, and GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need to take no action.¹ GitLab credits a researcher using the handle joaxcar, who reported it through its HackerOne bug bounty programme.¹

The Hacker News explains that the regular-expression compiler is Ruby's built-in Onigmo engine, which GitLab ships in its own packages, and says that is why the flaw reaches every release since 7.0.² It reports that GitLab backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9, which are older than the releases GitLab normally patches, and that GitLab has not said what conditions an attacker needs, so administrators cannot rule themselves out by configuration.² GitLab's notice confirms the backports and also published two threat detections for self-managed administrators, named "Onigmo native worker crash" and "Org mode render error burst".¹² The Hacker News says GitLab's advisory offers no interim workaround.²

According to The Hacker News, GitLab reports no sign that the flaw has been used in attacks, and it was not in CISA's catalogue of known exploited vulnerabilities as of 22 October.² It adds that this is the fourth code-execution flaw in GitLab's regular-expression engine reported by joaxcar in a month, and that administrators who updated on 12 October for CVE-2026-97229, an earlier unauthenticated 10.0 overflow in the same compiler fixed in 19.2.8, 19.3.5 and 19.4.2, are in the affected range again until they move to the new releases.² The 19.4.3 and 19.3.6 releases include database changes that run during the upgrade, which means downtime on single-node servers, according to The Hacker News.² GitLab's notice also lists other fixes, including two high-severity authentication and caching flaws, CVE-2026-15723 (CVSS 8.2, account takeover when SAML and LDAP auto-linking are both enabled) and CVE-2026-112212 (CVSS 7.5, poisoning of OAuth and OpenID Connect discovery endpoints).¹

Why it matters: the flaw needs no account and reaches back more than a decade, so administrators of older self-managed instances need a backported release rather than a routine upgrade, and the lack of detail on exploitation conditions means the patch is the only certain protection.¹²