Description

On October 21, 2026, GitLab released an emergency patch for CVE-2026-110264, an integer overflow vulnerability in the regular expression compiler (utilizing the Onigmo library in Ruby) bundled with GitLab. When processing a specially crafted regular expression supplied by an attacker, the vulnerability can allow arbitrary code execution on the GitLab server without requiring authentication.

Unlike CVE-2026-97229 (patched on October 12, which was exploited via regex in CI/CD configurations), CVE-2026-110264 features a different attack vector and a much wider scope: according to public analyses, the vulnerability is triggered when GitLab renders a specially crafted Org-mode file (.org) within a repository, causing the dangerous regular expression to be compiled. Consequently, servers that were already patched for CVE-2026-97229 on October 12 remain affected and must be patched again.

The vulnerability affects all GitLab CE and EE versions released since 7.0 (dating back to 2014), spanning approximately 12 years of releases; GitLab has backported the patch all the way back to the 18.11 branch. GitLab has not disclosed full prerequisites for exploitation and provides no alternative workarounds; upgrading is the sole remediation.

  • CVSS Score: 10.0

  • Severity: Critical

  • CWE-190: Integer Overflow

Scope of Impact

The vulnerability affects self-managed GitLab CE/EE instances from version 7.0 onwards. System administrators must review and upgrade immediately. Affected versions and corresponding patches:

  • GitLab 19.5.x: Upgrade to 19.5.1.

  • GitLab 19.4.x: Upgrade to 19.4.3 (includes a database migration).

  • GitLab 19.3.x: Upgrade to 19.3.6 (includes a database migration).

  • GitLab 19.2.x / 19.1.x / 19.0.x: Upgrade to 19.2.9 / 19.1.9 / 19.0.10 (security-only patch releases).

  • GitLab 7.0 through 18.11.x: Upgrade to 18.11.13 (backported security-only patch release); branches older than 18.11 must upgrade to 18.11.13 or a newer branch.

Note: GitLab.com has already been patched; GitLab Dedicated running 19.3.5-internal0, 19.4.2-internal0, or higher requires no further action. Servers patched for CVE-2026-97229 (on October 12) are still affected by CVE-2026-110264 and must be upgraded further. Patches for the 19.4 and 19.3 branches include database migrations.

Impact

Successful exploitation of the vulnerability can lead to:

  • Arbitrary code/command execution on the GitLab server without authentication, triggered by rendering a malicious .org file in a repository.

  • Access to source code, CI/CD variables, tokens, secret keys, and other credentials stored on GitLab.

  • Full server compromise, lateral movement to GitLab Runners and related infrastructure, and pipeline manipulation leading to supply chain attack risks.

Mitigation

  • Immediately upgrade self-managed GitLab CE/EE to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 (depending on your active branch). GitLab provides no workaround; upgrading is the only remediation. Note that patches for branches 19.4 and 19.3 contain database migrations: single-node systems will experience downtime, whereas multi-node systems should utilize zero-downtime upgrade procedures.

  • Servers that were patched for CVE-2026-97229 on October 12 must still be upgraded, as CVE-2026-110264 is a distinct vulnerability with a separate attack path.

  • Restrict internet access to the GitLab instance (via VPN or IP allowlists) until the patch update is fully completed.

  • Review logs and abnormal indicators. GitLab has released two Sigma rules (TLDR framework) for self-managed servers: detecting Onigmo native worker crashes ("Onigmo native worker crash") and Org-mode rendering error bursts ("Org mode render error burst"). Monitor for unusual processes spawned by GitLab and unexpected changes within repositories.

References

https://docs.gitlab.com/releases/

https://thehackernews.com/2026/10/critical-gitlab-flaw.html

https://cybersecuritynews.com/12-year-old-gitlab-vulnerability/

https://nvd.nist.gov/vuln/detail/cve-2026-110264