- GitLab released fixes for a critical vulnerability (CVE-2026-110264) that allows unauthenticated remote code execution on self-managed servers, affecting every version since 7.0.
- The flaw, rated 10.0 on the CVSS scale, originates from an integer overflow in Ruby’s Onigmo regular-expression engine that GitLab ships and patches in its own builds.
- This is the fourth such code-execution bug reported by researcher joaxcar in a month, with previous patches only covering versions 19.2 and later.
- GitLab has not disclosed the conditions required for exploitation and offers no workaround; administrators must upgrade to one of seven fixed versions.
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, affecting every version of the software going back to 7.0, released in 2014. The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum.
Under certain conditions, it could allow an unauthenticated user to run arbitrary code due to an integer overflow during the compilation of a specially crafted regular expression. GitLab has not said what those conditions are, and the company reports no sign the flaw has been used in attacks.
Only self-managed installations need to act; GitLab.com already runs the fixed version, and GitLab Dedicated tenants on internal releases 19.3.5-internal0 and later already have the fix. GitLab fixed the flaw in seven versions at once, including backports to older branches such as 18.11.13, a step reserved for severe issues.
The reason the flaw reaches so far back is the regular-expression compiler, Ruby’s built-in engine Onigmo, which GitLab ships inside its own packages and patches in its own builds. A weakness in that engine is present wherever GitLab has shipped it, which is every release since 7.0.
GitLab also published two detection rules to help administrators look for exploitation attempts, named “Onigmo native worker crash” and “Org mode render error burst,” part of the company’s open-source TLDR framework. GitLab has not said what preconditions an attacker needs, so the fix is the only certain protection.
This is the fourth code-execution flaw in GitLab’s regex engine that the same researcher, joaxcar, has reported in a month. On October 12, GitLab fixed CVE-2026-97229, also an unauthenticated 10.0 overflow, in versions 19.2.8, 19.3.5, and 19.4.2; on September 23, it fixed two more requiring a logged-in account.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
