GitLab Patches CVE-2026-110264, a CVSS 10.0 Unauthenticated RCE, in 19.5.1

An unauthenticated remote attacker could execute arbitrary code on a self-managed GitLab server by getting it to compile a specially crafted regular expression, under conditions GitLab does not spell out. The flaw, CVE-2026-110264, is scored 10.0 and is fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, all released October 21.

GitLab.com already runs the patched code. Self-managed installations of every version from 7.0 onward that predate those releases are affected.

What the advisory says, and what it leaves out

GitLab's patch release notes describe an integer overflow (CWE-190) in the regular expression compiler, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The reporter is joaxcar, through GitLab's HackerOne programme.

The score of 10.0 is defensible on the vector: network reachable, no privileges, no user interaction, changed scope. What the page does not say is which "certain conditions" trigger the overflow, or whether the compiler is reachable without an account on a default install. BleepingComputer reports no exploitation in the wild, and GitLab's notes list no workaround.

GitLab did publish two detections for self-managed operators: "Onigmo native worker crash" and "Org mode render error burst". The notes do not say what either detection has caught so far.

The other eleven fixes in the same release

The release carries 12 CVEs. Only one is critical; the next two are high.

CVE	Issue	CVSS
CVE-2026-110264	Integer overflow, regular expression compiler	10.0
CVE-2026-15723	OmniAuth-to-LDAP auto-linking authentication	8.2
CVE-2026-112212	Cache poisoning, OAuth/OIDC discovery endpoints	7.5
CVE-2026-12664	Access control, GraphQL work item email field	6.8

Eight further issues are rated 5.9 or lower, including several that affect only the Enterprise edition. Operators who stage upgrades should note that single-node instances will have downtime because migrations must finish before GitLab starts; multi-node instances can use zero-downtime procedures.

A second 10.0 regex-compiler flaw in about ten days

BleepingComputer says GitLab disclosed CVE-2026-97229, also a 10.0 flaw in the CI/CD regular expression compiler, roughly ten days earlier, reported by the same researcher. That pairing points to a component that has not been fully audited, which is a reason to patch this one promptly even without exploitation reports.

The same article cites a September precedent. GitLab fixed CVE-2026-85706, a maximum-severity flaw that exposes sensitive data, and CISA added it to its Known Exploited Vulnerabilities catalog one day later with a three-day deadline for federal agencies. Shadowserver tracks over 2,700 internet-exposed GitLab Community Edition instances, although it does not say how many are already patched.

What to do now

The fix was backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 as well as the current patch releases, so operators on older branches do not have to jump a minor version to be covered. Migrations ship in 19.4.3 and 19.3.6, with a post-deploy migration in 19.4.3, which is where the single-node downtime comes from.

Upgrade to the fixed release for your branch. GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later already have the fixes. Until you can, keep the instance off the open internet. Compare this with PHP2Shell, where exploitation started four days ahead of patches, and with the Plex2Shell chain, also listed as exploited this week.