CVE-2026-110264: GitLab CE/EE integer overflow in regular expression compiler allows unauthenticated remote code execution

GitLab says the bug sits in regular expression compilation: a specially crafted pattern makes an integer overflow while the engine compiles it, and that corrupts memory in a way that can be steered to code execution. Coverage of the release attributes the flaw to Onigmo, the regex engine built into Ruby that GitLab ships and patches in its own packages, which is why every release from 7.0 onward is affected rather than one feature. GitLab has not published the conditions that make it reachable, and its issue will stay private for 90 days.

The vector is the worst case: network reachable, low complexity, no privileges, no user interaction, and a scope change, because code running in GitLab's application processes can reach far beyond them. A self-managed GitLab server holds source code for every project, CI/CD variables and runner tokens, deploy keys, OAuth application secrets, and often credentials for cloud accounts and registries used by pipelines. Code execution there means an attacker can read or alter source, inject into builds, and pivot into everything the pipelines deploy to.

The same researcher, joaxcar, reported this through GitLab's HackerOne program; GitLab had fixed a separate regex flaw the week before. GitLab says it has seen no exploitation, and the CVE was not in CISA's KEV catalog on October 22, 2026.

Self-managed GitLab CE and EE, all deployment types (Omnibus, source, Helm chart): 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. GitLab.com is patched; Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action.

Versions 19.4.2, 19.3.5 and 19.2.8 from the October 12 release are still affected: they fixed a different regex bug. Check the running version:

sudo gitlab-rake gitlab:env:info | grep -i 'GitLab information' -A2
curl -s https://gitlab.example.com/api/v4/version -H "PRIVATE-TOKEN: <token>"

Lines older than 18.11 have no fixed release and must move to a supported line.

Upgrade to the fixed release for your line: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. On Omnibus:

sudo apt-get update && sudo apt-get install gitlab-ee=19.5.1-ee.0
# or gitlab-ce=19.5.1-ce.0; use your line's version
sudo gitlab-ctl reconfigure

GitLab offers no workaround. 19.4.3 and 19.3.6 include database migrations, so single-node servers will have downtime; multi-node setups can follow the zero-downtime upgrade procedure. Until you can upgrade, restrict who can reach the instance, for example with a VPN or an IP allow list in front of it.

GitLab published two threat detections for self-managed instances: Onigmo native worker crash, and Org mode render error burst. Look for Puma or Sidekiq workers dying with native crashes in the regex engine, bursts of rendering errors on files or wikis, and requests carrying unusually long or repetitive regular expression patterns. After an incident, review CI/CD variables, runner registration tokens, deploy keys, personal access tokens and admin accounts for changes, and rotate secrets the server holds if you find signs of compromise.

Under certain conditions, an unauthenticated user could have executed arbitrary code on the GitLab server due to an integer overflow when compiling a specially crafted regular expression. Impacted versions: GitLab CE/EE all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Fixed in GitLab CE/EE 19.5.1, 19.4.3 and 19.3.6, with backports to 19.2.9, 19.1.9, 19.0.10 and 18.11.13, released October 21, 2026.