GitLab Patches Critical Regex Flaw Affecting All Versions Since 2014
GitLab released emergency patches on October 21 for a critical vulnerability (CVE-2026-110264) that allows unauthenticated remote code execution on self-managed servers. The flaw, rated 10.0 on the CVSS scale, stems from an integer overflow in the Onigmo regular expression compiler and affects every release since version 7.0 in 2014. While GitLab reports no active exploitation, the issue requires immediate action for self-hosted instances, as cloud services are already patched. The update fixes seven version branches, including older releases outside standard support, and includes database changes that may cause downtime for single-node servers during upgrade.