GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No Workaround
Security / news
GitLab's CVSS 10.0 Regex Flaw Reaches Back to Version 7.0 and Has No Workaround
CVE-2026-110264 lets an unauthenticated user run code on self-managed servers, and GitLab has not said which feature reaches the vulnerable compiler.
An unauthenticated attacker can run code on a self-managed GitLab server (any CE or EE release from 7.0 up to the Oct. 21 patch builds) by sending a crafted regular expression, according to GitLab's advisory for CVE-2026-110264. GitLab rates it 10.0 on the CVSS 3.1 severity scale, and no workaround exists.
GitLab shipped the fix in an out-of-band critical patch release on Oct. 21: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later already carry the fixes.
Why a regex bug scores 10.0
The advisory says an integer overflow in the regular expression compiler lets an unauthenticated user execute arbitrary code on the server. The vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network reachable, low complexity, no privileges, no interaction, changed scope, full impact. On those preconditions the score is not inflated: no account, no click and no unusual setting is required, and the changed-scope metric reflects that code runs outside the component that was attacked.
What the advisory does not say is which feature that is. InfoWorld quotes GitLab only as saying "under certain conditions" the attack works, and reports an analyst's view that the flaw sits in shared regex handling, so other Ruby applications may carry the same bug. GitLab's two published detections for self-managed instances are named "Onigmo native worker crash" and "Org mode render error burst". Those names hint at a path through rendering Org mode files, but GitLab has not confirmed it.
Reporting credit goes to a HackerOne researcher using the handle joaxcar. Neither GitLab's page nor InfoWorld reports exploitation in the wild.
Which versions are exposed, branch by branch
The advisory's affected ranges mean that a server on 19.4.2 or 19.3.5 is still vulnerable, because the fixed builds are 19.4.3 and 19.3.6.
| Branch | Vulnerable up to | Fixed in |
|---|---|---|
| 7.0 to 18.11 | 18.11.12 | 18.11.13 |
| 19.0 | 19.0.9 | 19.0.10 |
| 19.1 | 19.1.8 | 19.1.9 |
| 19.2 | 19.2.8 | 19.2.9 |
| 19.3 | 19.3.5 | 19.3.6 |
| 19.4 | 19.4.2 | 19.4.3 |
| 19.5 | 19.5.0 | 19.5.1 |
The table is derived from GitLab's "before fix" ranges. The first row alone spans every release from 7.0 through 18.11.12.
Eleven other CVEs ship in the same release
GitLab fixed 12 CVEs in total. The second most serious is CVE-2026-15723, rated 8.2: when OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated user can take over an existing LDAP-backed account without any action from the victim. It reaches back to GitLab 10.1. CVE-2026-112212, rated 7.5, lets an unauthenticated user poison a shared cache's OAuth and OIDC discovery document to redirect certain flows to an external server.
One entry contradicts itself. The description of CVE-2026-105777, rated 4.3, calls the internal credential exposure through response headers unauthenticated, while its CVSS vector lists PR:L, meaning low privileges are required. GitLab's page does not reconcile the two, so the score may understate it.
- CVE-2026-110264 (regex compiler)10 CVSS
- CVE-2026-15723 (LDAP auto-linking)8.2 CVSS
- CVE-2026-112212 (OAuth/OIDC cache)7.5 CVSS
- CVE-2026-12664 (GraphQL email)6.8 CVSS
- CVE-2026-16255 (SAML/LDAP lock)5.9 CVSS
Source: GitLab critical patch release 19.5.1, accessed 2026-10-27
What to do, and when the details go public
Upgrade to the patched build on your branch. Single-node instances will have downtime because migrations must finish before GitLab starts, while multi-node instances can use zero-downtime procedures. Regular migrations run in 19.4.3 and 19.3.6, and 19.4.3 adds a post-deploy migration.
GitLab says public issues for these vulnerabilities will be released 90 days after the patch, which puts them around Jan. 19, 2027. Patch timing matters here: the earlier Plex2Shell chain was published 74 days after its fix, and the Cloudflare GLM 5.3 exposure was reported upstream on July 6 before it became public.
Sources
More in Security
- 01A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key BehindVersions 2.1.312 and 2.1.313 carried a 7,386-byte loader that plants an attacker key and a reverse tunnel. Uninstalling the extension does not remove either.
- 02Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 03Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 04KPMG Could Not Confirm the Deepfake in Capillary's €3 Million FraudCapillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.