GitLab fixes CVSS 10.0 flaw affecting self-managed releases back to 7.0
CVE-2026-110264 could allow an unauthenticated attacker to run code on self-managed GitLab servers. Instances updated on 12 October are in range again.
GitLab released fixes on 21 October for CVE-2026-110264, rated 10.0 on the CVSS scale, The Hacker News reports. Under certain conditions, an integer overflow while compiling a crafted regular expression could let an unauthenticated user run arbitrary code on a self-managed server. GitLab has not said what those conditions are.
The flaw sits in Onigmo, Ruby's regular-expression engine that GitLab ships, and affects every version back to 7.0 from 2014. The 12 October update covered only 19.2 and later, so instances updated then are in range again.
Fixed versions
19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com already runs the fix, as do GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later.
GitLab reports no sign of exploitation, and the flaw was not in CISA's known exploited vulnerabilities catalog as of 22 October. The report notes GitLab's advisory offers no interim workaround, and that the 19.4.3 and 19.3.6 upgrades include database migrations that cause downtime on single-node servers.