GitLab Patches a Second CVSS 10.0 Regex Overflow Nine Days After the First

GitLab shipped 19.5.1 on October 21 to fix CVE-2026-110264, an integer overflow in its regular expression compiler that carries a CVSS score of 10.0 and could let an unauthenticated user run code on the server. It is the second perfect-score regex overflow GitLab has patched in nine days.

The advisory, published on GitLab's patch release page, describes an issue that "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression." The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. GitLab credited a researcher using the handle joaxcar, who reported it through the company's HackerOne bounty program.

Two overflows, nine days apart

On October 12, GitLab released 19.4.2, 19.3.5 and 19.2.8 for CVE-2026-97229, also scored 10.0 and also credited to joaxcar, according to Help Net Security. Rapid7 published a technical analysis on October 16 showing the bug lives in Ruby's Onigmo regex engine, where a signed multiplication in the quantifier size check wraps to a negative number.

The new advisory does not mention CVE-2026-97229, and it does not say whether CVE-2026-110264 is a bypass of the earlier fix or a separate defect in the same compiler. The two share a bug class, a reporter and a score. They do not share a version range.

	CVE-2026-97229	CVE-2026-110264
Released	October 12, 2026	October 21, 2026
Earliest affected	19.2	7.0
Fixed in	19.4.2, 19.3.5, 19.2.8	19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
CVSS	10.0	10.0

Which versions are exposed

CVE-2026-110264 affects every GitLab CE and EE release from 7.0 before 18.11.13, plus 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. An instance that upgraded to 19.4.2 on October 12 is therefore on the affected list again until it reaches 19.4.3.

GitLab backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 as well as the three newest lines. GitLab.com already runs the patched version, and GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later need to do nothing.

Single-node self-managed instances should expect downtime. GitLab said regular migrations run in 19.4.3 and 19.3.6, and a post-deploy migration runs in 19.4.3, so a one-node install has to finish them before GitLab starts.

What GitLab did not say

The page lists no workaround and does not say whether anyone has exploited the bug. For the first flaw, Rapid7 reported no confirmed in-the-wild exploitation and warned that "Route controls do not repair the vulnerable Ruby compiler", which means blocking one API route is not a fix.

GitLab published two detection rules for self-managed operators, named "Onigmo native worker crash" and "Org mode render error burst". The second name suggests a trigger path through Org mode markup rather than the CI lint endpoint Rapid7 used for the first bug. GitLab does not say so, and The Terminal has not seen a public proof of concept for CVE-2026-110264.

Memory-safety fixes have been landing across common server software this month. The Terminal covered the PHP out-of-memory fixes in 8.5.12 and Anthropic's account of Claude finding pre-authentication code in OpenSSH.

GitLab recommends that all self-managed installations upgrade to one of the seven patched versions immediately. The release also carries 11 other security fixes, the highest of them CVE-2026-15723 at CVSS 8.2, which needs both OmniAuth SAML and LDAP auto-linking enabled.