Critical GitLab Flaw (CVSS 10.0) Threatens RCE Across 12 Years of Releases

On October 21 GitLab released fixes for a flaw that, under certain conditions, lets an unauthenticated user run arbitrary code on a self-managed server. Tracked as CVE-2026-110264, it carries the maximum CVSS score of 10.0.

The cause is an integer overflow during the compilation of a specially crafted regular expression. GitLab has not disclosed what conditions are required, so administrators cannot yet rule themselves out by configuration. There is no sign the flaw has been exploited, and it was not in the U.S. CISA catalog of known exploited vulnerabilities as of October 22.

Why it reaches so far back

The vulnerable component is Onigmo, Ruby's built-in regular-expression engine, which GitLab ships and patches inside its own builds. A weakness in that engine is present wherever GitLab has shipped it — meaning every release since version 7.0, which dates to 2014.

The fix matters even for those who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again.

The fixes and their reach

GitLab closed the hole in seven versions at once: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Four of those are older than the company normally patches — its policy covers the current and previous two monthly releases. Backporting to retired branches is a step GitLab reserves for severe issues.

Only self-managed installations need to act. GitLab.com already runs the fixed version, and GitLab Dedicated tenants received the fix through internal releases.

A run of findings, and the rest

This is the fourth code-execution flaw in GitLab's regular-expression engine reported in a month by a researcher using the handle joaxcar, and the first to reach versions before 19.2. To help spot exploitation attempts, GitLab published two Sigma-format detections as part of its open-source TLDR framework.

The October release fixes 11 security issues in all — one critical, the rest high, medium or low. Among them are a possible account takeover (CVE-2026-15723) and a cache-poisoning flaw in GitLab's OAuth endpoints (CVE-2026-112212).

Upgrading to 19.4.3 and 19.3.6 includes database changes that run during the upgrade, so a single-node server faces downtime while they finish. Multi-node setups can apply the patch without downtime using the zero-downtime procedure.

Source: The Hacker News