Critical GitLab Flaw CVE-2026-110264 Carries CVSS 10.0 Rating and Affects Versions Dating Back to 2014

GitLab has released security updates addressing a critical vulnerability tracked as CVE-2026-110264, which carries a maximum CVSS score of 10.0. According to the company's advisory, the flaw could theoretically allow an unauthenticated attacker to execute arbitrary code on self-managed servers under certain conditions. The issue stems from an integer overflow during the compilation of a specially crafted regular expression using Ruby's built-in Onigmo engine.

Scope and Impact

• Affected Versions: Every release dating back to version 7.0, originally released in 2014.
• Deployment Status: GitLab.com and managed GitLab Dedicated tenants running specified internal releases already include the fix. Only self-managed installations need to apply updates manually.
• Attack Status: GitLab reported no evidence of active exploitation in the wild, and the vulnerability was not listed in the U.S. CISA known exploited vulnerabilities catalog as of October 22.

Patch Details and Backporting

The October 21 security release addresses the flaw across seven distinct versions simultaneously. Because the vulnerability affects software branches far older than GitLab's standard support policy—which normally covers only the current release and the previous two monthly versions (19.5, 19.4, and 19.3)—the company backporting the fix to older builds including 18.11.13, 19.0.10, 19.1.9, and 19.2.9.

Administrators who applied patches on October 12 for a previous advisory must update again, as those earlier fixes only covered versions 19.2 and later, leaving instances within the newly released patch levels vulnerable.

Mitigation and Verification

• No Workaround: GitLab has not provided an interim configuration workaround, making immediate patching the sole confirmed protection.
• Detection Rules: GitLab published two open-ствие detection rules named "Onigmo native worker crash" and "Org mode render error burst" using the Sigma format within its TLDR framework to help administrators monitor logs for exploitation attempts.
• Upgrade Considerations: Upgrades to versions 19.4.3 and 19.3.6 include database migrations. Single-node servers will experience downtime during the process, while multi-node architectures can utilize zero-downtime procedures.

To verify announcements and apply updates, administrators should consult the official GitLab security advisory and review application logs using the provided detection rules.