GitLab CVSS 10.0 RCE Flaw: CVE-2026-110264 and Patched Versions

On October 21, GitLab patched a critical vulnerability that could allow code execution on self-managed servers without logging in. Tracked as CVE-2026-110264, the flaw carries the highest score possible on the CVSS scale, 10.0, and affects every version since 7.0, released in 2014.

On top of that, having updated on October 12 may not protect you. In this post I'll explain what the flaw is, which version you need to move to, and what you should check. For more details, see also The Hacker News report.

What Is CVE-2026-110264?

According to GitLab's description, under certain conditions an unauthenticated user can execute arbitrary code on the server (Remote Code Execution – RCE). The cause is an integer overflow that occurs while compiling a specially crafted regular expression.

There is a critical uncertainty here: GitLab has not disclosed what those "certain conditions" are. In other words, we don't know what an attacker needs in order to reach the compiler.

The company says there is no sign that the flaw has been used in attacks. As of October 22, it is also not listed in the US CISA's Known Exploited Vulnerabilities catalog.

Why Does the Flaw Go Back 12 Years?

The vulnerable component is Onigmo, Ruby's built-in regular expression engine. GitLab ships this engine inside its own packages and patches it in its own builds. The vulnerability in the engine is present everywhere GitLab ships it. That means every release since 7.0.

This is not the first in a string of such flaws. The same researcher (under the handle joaxcar) has reported the fourth code execution vulnerability in the regular expression engine within a month:

• September 23: CVE-2026-93577 and CVE-2026-89078, both 9.9, both requiring a logged-in account
• October 12: CVE-2026-97229, an unauthenticated 10.0 overflow, fixed in versions 19.2.8, 19.3.5 and 19.4.2
• October 21: CVE-2026-110264, again 10.0

The first three stopped at 19.2. This one doesn't. It is the first to reach back before 19.2.

Which Version Should You Upgrade To?

GitLab fixed the flaw in seven releases at once. Depending on the release line you're on, the target version is:

• 19.5 line, before 19.5.1: 19.5.1
• 19.4 line, before 19.4.3: 19.4.3
• 19.3 line, before 19.3.6: 19.3.6
• 19.2 line, before 19.2.9: 19.2.9
• 19.1 line, before 19.1.9: 19.1.9
• 19.0 line, before 19.0.10: 19.0.10
• 7.0 through 18.11, before 18.11.13: 18.11.13

GitLab's normal policy is to patch the current release and the previous two monthly releases. Today those are 19.5, 19.4 and 19.3. So four releases fall outside the policy. For 18.11.13, 19.0.10, 19.1.9 and 19.2.9, GitLab did additional backports. It only takes this step for serious vulnerabilities.

If You Applied the October 12 Patch

Here is the real trap. The October 12 update only covered 19.2 and later. The newly fixed releases sit one patch above that fix. An instance that was updated nine days ago therefore falls back into the affected range.

In short, "we patched last week" is not enough for this vulnerability.

Is There an Attack? How to Detect It

GitLab has published two detection rules for self-managed administrators: "Onigmo native worker crash" and "Org mode render error burst". They are part of GitLab's open source TLDR framework. Each rule is written in Sigma format and runs against GitLab's own application logs.

⚠️ These rules only help you look for attack attempts. They do not provide protection. GitLab's advisory offers no workaround. And since the preconditions are unknown, you can't look at your configuration and conclude "I'm not affected" either. The only certain protection is moving to a patched version.

Other Vulnerabilities in the Same Update

The October 21 release fixes 11 security issues in total: one critical, the rest high, medium and low. Two on the authentication side stand out:

• CVE-2026-15723 (High, 8.2): May allow a logged-in user to take over another account. But only if the administrator has enabled both SAML and LDAP auto-linking
• CVE-2026-112212 (High, 7.5): Cache poisoning on OAuth and OpenID Connect endpoints. In setups using a shared cache, an attacker could redirect some login flows to their own server

Who Is Affected / What Should You Do?

Only self-managed installations are affected. GitLab.com is already running the fixed version. GitLab Dedicated tenants are also patched if they are on 19.3.5-internal0 and 19.4.2-internal0 or later.

If you run GitLab on your own server, follow these steps:

Step 1 — Determine your version and release line. Even if you updated on October 12, check the list above.

Step 2 — Upgrade to the version that corresponds to your line. For example, if you're on 19.4, move to 19.4.3; if you're between 7.0 and 18.11, move to 18.11.13.

Step 3 — Enable the detection rules. Run the "Onigmo native worker crash" and "Org mode render error burst" rules against your logs.

Step 4 — Review the other vulnerabilities as well. If you use SAML and LDAP auto-linking together, or a shared cache, CVE-2026-15723 and CVE-2026-112212 may concern you too.

ℹ️ Important note: Versions 19.4.3 and 19.3.6 include database changes that run during the upgrade. On a single-node server, this means downtime until the operations finish. GitLab says multi-node installations can apply the patch without downtime using the zero-downtime procedure. Plan your maintenance window accordingly.