GitLab Patches Critical Regex Flaw Affecting All Versions Since 2014
GitLab released emergency patches on October 21 for a critical vulnerability (CVE-2026-110264) that allows unauthenticated remote code execution on self-managed servers. The flaw, rated 10.0 on the CVSS scale, stems from an integer overflow in the Onigmo regular expression compiler and affects every release since version 7.0 in 2014. While GitLab reports no active exploitation, the issue requires immediate action for self-hosted instances, as cloud services are already patched. The update fixes seven version branches, including older releases outside standard support, and includes database changes that may cause downtime for single-node servers during upgrade.
Key points
- CVE-2026-110264 is a critical (CVSS 10.0) vulnerability allowing unauthenticated remote code execution via integer overflow in the Onigmo regex compiler.
- The flaw affects all GitLab versions from 7.0 (2014) through 18.11, as the vulnerable compiler is bundled in GitLab’s packages.
- GitLab fixed the issue in seven version branches, including four older releases (18.11.13, 19.0.10, 19.1.9, 19.2.9) outside its standard support policy.
- Self-managed users must upgrade immediately; GitLab.com and Dedicated tenants on specific internal releases are already patched.
- The October 21 release also fixes 10 other security issues, including high-severity flaws in authentication and OAuth cache poisoning.
- No active exploitation has been reported, and the vulnerability is not listed in the CISA known exploited vulnerabilities catalog as of October 22.
Background
This is the fourth critical flaw in GitLab’s regex engine reported by researcher 'joaxcar' in one month. Previous issues (CVE-2026-97229, CVE-2026-93577, CVE-2026-89078) affected only versions 19.2 and later, while this new flaw reaches back to 2014. Earlier in October, GitLab also patched a critical AI Gateway flaw (CVE-2026-90970) and an unauthenticated file-read issue in Atlassian products. The current patch follows a September 23 update for two high-severity regex flaws that required authentication.
Why it matters
The vulnerability’s reach across 12 years of releases and its maximum severity rating make it a high-priority risk for self-managed GitLab users. The lack of a workaround means patching is the only mitigation, and the required database changes during upgrade may necessitate planned downtime for single-node servers. Administrators should prioritize upgrading to the fixed versions to prevent potential unauthenticated code execution.
What to watch
Self-managed GitLab administrators must upgrade to the fixed versions (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13) as soon as possible. GitLab has published two detection rules ('Onigmo native worker crash' and 'Org mode render error burst') to help identify exploitation attempts. Users should monitor logs and plan for potential downtime during the upgrade process, especially for single-node setups.
Want the full story? Read the original reporting
Read on The Hacker News