GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated code-execution flaw in every version since 7.0

GitLab has released emergency patches for CVE-2026-110264, a flaw rated 10.0 on the CVSS scale, the maximum, that GitLab says could let an unauthenticated attacker run code on a self-managed server. The advisory, published on 21 October 2026, says every version from 7.0 onward is affected until it is upgraded. It also lands only nine days after GitLab fixed a different 10.0 flaw in the same part of the software, so administrators who patched on 12 October are in range again.

Key points

• GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on 21 October 2026; the critical bug is CVE-2026-110264, CVSS 10.0, an integer overflow when GitLab compiles a specially crafted regular expression.
• Affected: all self-managed GitLab CE/EE versions from 7.0 before the fixed version on each branch. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action.
• The release fixes 12 security issues in total by GitLab's own table: one critical, two high, five medium, four low.
• GitLab's advisory does not report exploitation and lists no workaround; upgrading is the only fix it names.
• On a single-node install the upgrade means downtime, because database migrations must finish before GitLab starts.

What happened

GitLab's critical patch release notes, dated 21 October 2026, describe CVE-2026-110264 as a flaw that "under certain conditions" could allow an unauthenticated user to execute arbitrary code on the GitLab server. The cause is an integer overflow in the regular expression compiler. The CVSS vector GitLab publishes (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reads as: reachable over the network, low complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability. The researcher who goes by joaxcar reported it through GitLab's HackerOne bug bounty programme.

The affected range is wide. GitLab lists all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. The table below pairs each branch with its fix.

If you run	Upgrade to
19.5	19.5.1
19.4	19.4.3
19.3	19.3.6
19.2	19.2.9
19.1	19.1.9
19.0	19.0.10
7.0 through 18.11	18.11.13

GitLab normally patches only the current release and the previous two monthly releases, which today are 19.5, 19.4 and 19.3, according to The Hacker News. Four of the fixed versions (18.11.13, 19.0.10, 19.1.9 and 19.2.9) are older backports GitLab issued because of the severity. GitLab lists no fixed release for versions older than 18.11, so those installations have to move to one of the fixed lines.

GitLab also published two detection rules for self-managed administrators, named "Onigmo native worker crash" and "Org mode render error burst". The names point at the places to look in application logs: crashes of the native regex worker and bursts of errors when rendering Org-mode markup. GitLab has not published what the "certain conditions" are, so we cannot tell you which configurations are or are not reachable.

Background

This is the second maximum-severity regex-compiler flaw in under two weeks. On 12 October 2026 GitLab released 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, also rated 10.0, also an integer overflow, also reported by joaxcar. That one affected versions from 19.2 before the fixed versions and concerned a specially crafted regular expression in CI/CD configuration, with GitLab citing insufficient validation. GitLab released six detection rules with it.

The Hacker News adds that the same researcher reported two more code-execution flaws in the regex engine on 23 September, CVE-2026-93577 and CVE-2026-89078, each rated 9.9 but needing a logged-in account, and that the earlier flaws stopped at version 19.2 while this one reaches back to 7.0. We confirmed the 12 October release on GitLab's own page; the 23 September detail is The Hacker News's account and we did not open GitLab's notice for it.

The "Onigmo" in the detection name is the regular expression engine used by Ruby. The Hacker News explains that GitLab ships it inside its own packages and patches it in its own builds, which is why a weakness in the engine appears in every release that includes it. GitLab's changelog for the new patch lists Ruby regexp fixes (a repeat-ID overflow patch for several Ruby versions on the 19.x branches and a repeat-range double-free patch on 18.11), which fits that explanation, though GitLab's advisory does not spell out the link between those changes and the CVE.

Our recent coverage shows the same pattern of server-side flaws arriving in clusters this month: PHP's two critical remote code execution flaws and Node.js's ten CVEs including a Brotli remote code execution flaw.

The numbers

GitLab's table lists 12 security fixes in this release. Counting by the severity labels in that table gives:

Medium5

Low4

High2

Critical1

Security fixes in GitLab's 21 October 2026 patch release, by severity (issues)

	issues
Medium	5
Low	4
High	2
Critical	1

Source: GitLab critical patch release notes, 21 October 2026

The Daily CyberSecurity roundup also counts 12 (1 critical, 2 high, 5 medium, 4 low). The Hacker News says 11. We follow GitLab's own table.

The two high-severity issues are both about identity. CVE-2026-15723 (CVSS 8.2) could let a logged-in user take over an existing LDAP-backed account, but GitLab says only when OmniAuth SAML and LDAP auto-linking are both enabled; it affects versions from 10.1 before the fixed ones. CVE-2026-112212 (CVSS 7.5) is a cache-poisoning issue in the OAuth/OIDC discovery endpoints: an unauthenticated user could poison a shared cache so that certain sign-in flows redirect to a server they control. It affects versions from 18.3. The medium and low items include a GraphQL issue that let a token limited to read-only API access read a project's incoming email address and create work items, and several access-control gaps in group, merge request and Duo settings.

What it means

For administrators of self-managed GitLab: treat this as an emergency change. GitLab holds source code, CI secrets, deploy tokens and often production credentials, so a server takeover is usually far more than one machine lost. If your instance is reachable from the internet, upgrading is the first job; if you cannot upgrade today, restricting who can reach it is the only mitigation we can suggest, and it is our suggestion, not GitLab's.

For anyone who patched on 12 October: that update does not protect you from this bug. The Hacker News points out that the new fixed versions sit one patch above those from nine days ago, so a fully patched instance on 19.4.2 is vulnerable until it reaches 19.4.3.

For teams on 18.x and older: the fix for 7.0 through 18.11 exists only as 18.11.13. Installations on older minor versions must first upgrade to that line, which may mean several upgrade hops.

For planning: GitLab says the patch includes database migrations. On a single-node installation, GitLab states, the upgrade causes downtime because migrations must complete before GitLab can start; multi-node setups using its zero-downtime procedure can apply it without downtime. Schedule a window rather than discovering this mid-upgrade.

For the wider industry: a run of maximum-severity flaws in one component from one researcher in a month is a reminder that embedded language runtimes and their regex engines are part of an application's attack surface. Hunting for these classes of bug in shared engines tends to pay off repeatedly, and every vendor that bundles the same engine should be looking too.

What we don't know yet

• Which configurations are actually reachable. GitLab says "under certain conditions" and has not said what they are.
• Whether anyone is exploiting it. GitLab's notice does not report exploitation, and The Hacker News says the flaw was not in the US CISA known-exploited catalogue as of 22 October. A page from a third party found in search describes an active campaign; we could not open it and found no corroboration, so we do not rely on it.
• Whether a public proof of concept exists. None was reported by the sources we read.
• How many self-managed servers are exposed. No source gives a count.

What to watch next

• Any change to GitLab's advisory that adds the conditions or a workaround.
• CISA's known-exploited-vulnerabilities catalogue and GitLab's own threat-detection updates.
• GitLab's public issue for the bug: GitLab says vulnerability issues are made public 90 days after the release that fixed them, which would be around January 2027.
• Further regex-engine fixes from the same researcher, given the pattern since September.

Sources

• GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (GitLab, primary source)
• GitLab patch release 19.4.2, 19.3.5, 19.2.8 (GitLab, 12 October 2026)
• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (The Hacker News)
• GitLab Critical Patch Release Fixes 10.0 CVSS Remote Code Execution Flaw and 11 Other Bugs (Daily CyberSecurity)