Overview
On October 21, 2026, GitLab released fixes for CVE-2026-110264, a CVSS 10.0 flaw that could let an unauthenticated attacker run arbitrary code on a self-managed server. It affects every release back to version 7.0 (2014).
The bug is an integer overflow during compilation of a specially crafted regular expression in Onigmo, the regex engine GitLab ships in its packages. GitLab has not said which conditions are required for code execution.
Not Covered by the October 12 Patch
Administrators who patched on October 12 still need this update. That release fixed CVE-2026-97229, another unauthenticated 10.0 regex overflow reported by the same researcher, but the earlier flaws affected only version 19.2 and later. This one reaches much further back.
Fixed Versions
| If you run | Upgrade to |
|---|---|
| 19.5 | 19.5.1 |
| 19.4 | 19.4.3 |
| 19.3 | 19.3.6 |
| 19.2 | 19.2.9 |
| 19.1 | 19.1.9 |
| 19.0 | 19.0.10 |
| 7.0 through 18.11 | 18.11.13 |
The 18.11.13, 19.0.10, 19.1.9, and 19.2.9 releases are backports outside GitLab's normal support window. Only self-managed installations need action: GitLab.com is already fixed, and GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later are covered.
Exploitation Status
GitLab reports no sign the flaw has been used in attacks, and it was not in CISA's KEV catalog at the time of writing. The advisory offers no interim workaround.
Recommended Actions
- Upgrade to the fixed version for your branch as soon as possible
- Plan for downtime on single-node servers for 19.4.3 and 19.3.6, which include database changes; multi-node setups can use GitLab's zero-downtime procedure
- Review logs for the detection rules "Onigmo native worker crash" and "Org mode render error burst" from GitLab's open-source TLDR framework (Sigma format)
- Restrict internet exposure of self-managed instances until patched