GitLab released fixes on October 21 for CVE-2026-110264, a flaw rated 10.0 on the CVSS scale (the maximum) that, under certain conditions, could let an unauthenticated user run arbitrary code on a self-managed GitLab server. GitLab says the cause is an integer overflow when its regular-expression compiler processes a specially crafted pattern. The company has not said what the conditions are, and its advisory offers no interim workaround, so The Hacker News reports that administrators cannot rule themselves out by configuration. GitLab reports no sign of attacks using the flaw.
The affected range is unusually wide: every version from 7.0 onward, back to 2014. That includes instances updated on October 12, when GitLab fixed a similar flaw, CVE-2026-97229, only in versions 19.2 and later; the new fixed releases sit one patch above those. GitLab.com already runs the fixed version, and GitLab Dedicated is patched. The Hacker News counts this as the fourth code-execution flaw in GitLab’s regex engine reported by the same researcher (handle joaxcar) in a month, and the first that reaches releases before 19.2. The October 21 release fixes 11 security issues in total, one critical and the rest high, medium or low.
How to check if you’re affected
Affected versions are all self-managed GitLab CE/EE installations from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, per GitLab’s advisory. Upgrade to the fix for your branch:
- 19.5: 19.5.1
- 19.4: 19.4.3
- 19.3: 19.3.6
- 19.2: 19.2.9
- 19.1: 19.1.9
- 19.0: 19.0.10
- 7.0 through 18.11: 18.11.13
GitLab backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9, versions outside its normal patch window, which it reserves for severe issues. If you updated on October 12, check your version again: it is likely still below the new fixed release. GitLab also published two detections for self-managed administrators to look for exploitation attempts, named “Onigmo native worker crash” and “Org mode render error burst”, described in its security-incident documentation linked below.