GitLab’s CVSS 10 Regex Bug Reaches Back 12 Years to Version 7.0
GitLab fixed CVE-2026-110264, a CVSS 10.0 flaw in its bundled Ruby regex engine that could let unauthenticated attackers run code on self-managed servers as old as version 7.0. No exploitation seen yet, and no workaround.
GitLab shipped emergency patches on Oct. 21 for CVE-2026-110264, a CVSS 10.0 bug that could let someone with no account run code on a self-managed GitLab server. The flaw sits in Onigmo, the regular-expression engine inside Ruby that GitLab bundles, and it reaches all the way back to GitLab 7.0 from 2014, The Hacker News reports. GitLab’s release post says the fix is backported to seven release lines, including four that are past their normal support window. GitLab says it hasn’t seen the bug used in attacks.
For defenders
The bug: CVE-2026-110264, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). An integer overflow when Onigmo compiles a specially crafted regular expression. GitLab says an unauthenticated user could execute code “under certain conditions” and hasn’t said what those are, so you can’t rule yourself out by configuration. Credited to joaxcar via HackerOne.
| Running (CE/EE) | Upgrade to |
|---|---|
| 7.0 through 18.11.x | 18.11.13 |
| 19.0 / 19.1 / 19.2 | 19.0.10 / 19.1.9 / 19.2.9 |
| 19.3 / 19.4 / 19.5 | 19.3.6 / 19.4.3 / 19.5.1 |
Status: No known exploitation per GitLab, not in CISA’s KEV catalog as of Oct. 22 according to The Hacker News, and no public PoC reported. No workaround is offered. GitLab.com is already patched; Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action.
Context: The Hacker News says this is the fourth code-execution bug in the same engine from the same researcher in a month, after CVE-2026-97229 (CVSS 10.0, Oct. 12) and CVE-2026-93577 and CVE-2026-89078 (CVSS 9.9, Sept. 23). If you patched on Oct. 12, you still need this release.
Also fixed: ten more issues, including CVE-2026-15723 (CVSS 8.2, account takeover when SAML and LDAP auto-linking are both on) and CVE-2026-112212 (CVSS 7.5, OAuth/OIDC discovery cache poisoning). CVE-2026-105777 (CVSS 4.3) lets an unauthenticated user pull internal credentials from response headers.
Detection: GitLab published two rules for self-managed logs: Onigmo native worker crash and Org mode render error burst.
What it means for you
GitLab is where many companies keep their source code and run their software builds. If someone took over that server, they could read or change your code and the secrets stored next to it. If you use gitlab.com, GitLab has already fixed it for you. If you or your IT provider run your own GitLab server, it needs updating today, even if it was updated last week.
Do this now
- Check your GitLab version on its /help page and upgrade to the matching fixed release in the table above. Instances older than 18.11 go to 18.11.13.
- Plan for downtime on single-node servers: 19.3.6 and 19.4.3 run database migrations before GitLab starts. Multi-node setups can use GitLab’s zero-downtime upgrade path.
- Load GitLab’s two detection rules and look back through your logs for Onigmo worker crashes or bursts of Org mode render errors.
- If the server faces the internet and you can’t patch today, restrict access to VPN or known IPs until you can.
CVE at a glance
- CVSS
- 10 Critical (v3.1)
- EPSS
- 0.5% chance of exploitation in the next 30 days (higher than 42.2% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 3 GitHub repositories
- CVSS
- 8.2 High (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 25.5% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- CVSS
- 7.5 High (v3.1)
- EPSS
- 0.2% chance of exploitation in the next 30 days (higher than 8.2% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- CVSS
- 4.3 Medium (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 15.4% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.