What is CVE-2026-110264?
CVE-2026-110264 is an integer overflow in the regular expression compiler that ships with GitLab. According to GitLab’s security advisory, “under certain conditions” an unauthenticated user can run arbitrary code on the server by getting it to compile a specially crafted regular expression.
The compiler is Onigmo, the regex engine built into Ruby. GitLab bundles and patches Onigmo in its own packages. GitLab hasn’t said which conditions an attacker needs, so every self-managed instance reachable over the network should be treated as exposed.
The researcher joaxcar reported the flaw through GitLab’s HackerOne bug bounty program.
Which GitLab versions are affected?
| If you run | Upgrade to |
|---|---|
| 19.5 before 19.5.1 | 19.5.1 |
| 19.4 before 19.4.3 | 19.4.3 |
| 19.3 before 19.3.6 | 19.3.6 |
| 19.2 before 19.2.9 | 19.2.9 |
| 19.1 before 19.1.9 | 19.1.9 |
| 19.0 before 19.0.10 | 19.0.10 |
| 7.0 through 18.11, before 18.11.13 | 18.11.13 |
GitLab normally patches only the current release and the two before it (maintenance policy), which today means 19.5, 19.4 and 19.3. This time it also shipped fixes for 19.2, 19.1, 19.0 and 18.11.
GitLab.com already runs the fixed code. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later already have the fix.
I patched on October 12. Am I covered?
No. The October 12 critical release fixed CVE-2026-97229, a different unauthenticated regex RCE that is also rated CVSS 10.0. It did not fix CVE-2026-110264, so you need the October 21 versions as well.
According to The Hacker News, this is the fourth code-execution flaw in the regex engine reported by the same researcher in about a month:
| CVE | CVSS | Login needed? | Fixed |
|---|---|---|---|
| CVE-2026-93577 | 9.9 | Yes | September 23 |
| CVE-2026-89078 | 9.9 | Yes | September 23 |
| CVE-2026-97229 | 10.0 | No | October 12 (19.2.8, 19.3.5, 19.4.2) |
| CVE-2026-110264 | 10.0 | No | October 21 (all versions above) |
CVE-2026-110264 is the first of the four to reach versions older than 19.2.
Is CVE-2026-110264 being exploited?
GitLab reports no sign of exploitation so far. As of October 22, the CVE was not in CISA’s Known Exploited Vulnerabilities catalog.
How to detect exploitation attempts?
GitLab offers no workaround. Upgrading is the only fix. For detection, GitLab published two rules in its open-source TLDR detection repository:
- Onigmo native worker crash
- Org mode render error burst
Run both against your GitLab application logs, ideally covering the period before you upgraded as well.
Other vulnerabilities fixed on October 21
The release fixes 12 vulnerabilities in total: 1 critical, 2 high, 5 medium and 4 low. The two high-severity ones:
- CVE-2026-15723 (CVSS 8.2): a logged-in user can take over another account. This only works when an administrator has turned on both SAML and LDAP auto-linking.
- CVE-2026-112212 (CVSS 7.5): cache poisoning on the OAuth and OpenID Connect discovery endpoints. In setups with a shared cache, it can send some sign-in flows to an attacker’s server.
Upgrade notes for DevOps teams
19.4.3 and 19.3.6 include database migrations, and 19.4.3 also runs a post-deploy migration. A single-node instance goes down until the migrations finish. A multi-node setup can avoid downtime by following GitLab’s zero-downtime upgrade procedure.
Patch internet-facing instances first. Internal instances come next, but don’t leave them for later: the flaw needs no login, so anyone who can reach the server on your internal network can try it.
A GitLab server usually holds source code, CI/CD variables, deploy tokens and runner registrations, and an attacker who can run code on it may be able to read all of these. If your team needs help planning the upgrade or hardening a self-managed GitLab, talk to the fireup.pro DevOps team.
