GitLab released fixes on October 21 for CVE-2026-110264, a maximum-severity vulnerability that could let an unauthenticated attacker run arbitrary code on a self-managed GitLab server. The issue affects the regular-expression compiler and stems from an integer overflow when it processes a specially crafted expression. The immediate impact is operational: administrators must identify their release branch and install the corresponding patched version.

The unusually broad scope comes from the component involved. GitLab ships and patches the Onigmo regular-expression engine inside its own packages, and the vulnerable engine is present in releases dating back to GitLab 7.0. GitLab.com is already running a fixed version, while GitLab Dedicated tenants on the stated internal releases already include the fix. The action therefore applies primarily to self-managed installations.

Administrators should not assume that an update installed on October 12 is sufficient. That earlier update covered only versions 19.2 and later, while the new fixed releases are one patch level above it. GitLab has now corrected the issue in versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1.

The available evidence does not establish that this particular vulnerability is being exploited. GitLab reported no sign of attacks, and the flaw was not in the U.S. CISA catalog of known exploited vulnerabilities as of October 22. That does not remove the need to patch: GitLab has not disclosed the conditions required to reach the compiler, so administrators cannot safely exclude their configuration based on the available advisory.

GitLab has also published two detection rules for self-managed administrators investigating possible exploitation attempts: “Onigmo native worker crash” and “Org mode render error burst.” They are intended for GitLab application logs and are not presented as a replacement for the upgrade. The advisory offers no interim workaround, making the corrected release the certain protection described in the evidence.

Patch planning should account for deployment architecture. The 19.4.3 and 19.3.6 updates include database changes that can cause downtime on a single-node server while they run. GitLab says multi-node deployments can use its zero-downtime procedure, so teams should schedule and test the upgrade according to their topology rather than treating every installation as operationally identical.

Sources

• GitLab warns of new max severity code execution vulnerability
• Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases