It affects every GitLab release back to 7.0, released in 2014.
CVE-2026-110264 and the Onigmo integer overflow
On October 21, GitLab shipped fixes for CVE-2026-110264, a vulnerability the company rates at 10.0 on the CVSS scale. GitLab says the flaw can, under certain conditions, allow an unauthenticated user to run arbitrary code on a self-managed server. The underlying fault is an integer overflow that occurs during compilation of a specially crafted regular expression by the Onigmo engine – Ruby's built-in regular-expression compiler, which GitLab packages and patches inside its own builds.
GitLab has not published the specific preconditions an attacker would need to reach the compiler, and the advisory offers no interim workaround. The company reports no sign the flaw has been used in attacks, and as of October 22 the issue is not listed in the U.S. CISA catalog of known exploited vulnerabilities.
Affected releases, backports, and the Oct. 12 patch gap
GitLab fixed the flaw across seven release branches at once. Unusually, four of the fixed versions are older than the releases GitLab normally supports under its policy, which covers the current release and the previous two monthly releases — identified by GitLab as 19.5, 19.4, and 19.3 as of today. In response to severity, GitLab backported the fix to 18.11.13, 19.0.10, 19.1.9, and 19.2.9.
Administrators who applied GitLab's October 12 update should note an important operational detail: the October 12 update addressed a different overflow (CVE-2026-97229) and covered only versions 19.2 and later. The October 21 fixed versions sit one patch above that October 12 set, which means an instance updated on October 12 can fall back into the vulnerable range and must be updated again to obtain the October 21 fixes.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogDetection rules: TLDR Sigma signatures for administrators
To help defenders, GitLab published two detection rules as part of its open-source TLDR framework. The rules are named "Onigmo native worker crash" and "Org mode render error burst." Each detection is written in the Sigma format and targets GitLab application logs, giving self-managed administrators a way to look for signs of exploitation attempts while they plan or perform upgrades.
Despite those signatures, GitLab explicitly states the only certain protection is the update itself because the company has not detailed the exact paths to the vulnerable compiler.
Operational impact: database migrations, downtime, and zero-downtime guidance
The October 21 release bundle addressed 11 security issues in total — one critical and the rest rated high, medium, or low. Two other fixes of note include CVE-2026-15723 (high, 8.2), which could let a logged-in user take over another account if an administrator has enabled both SAML and LDAP auto-linking, and CVE-2026-112212 (high, 7.5), a cache-poisoning issue in OAuth and OpenID Connect endpoints that can redirect certain sign-in flows in setups using a shared cache.
GitLab warns that the 19.4.3 and 19.3.6 releases include database changes that run during the upgrade. On a single-node server, those database migrations mean downtime while they complete. Multi-node setups can apply the patch without downtime by following GitLab's zero-downtime upgrade procedure.
How self-managed administrators, GitLab.com tenants, and GitLab Dedicated are positioned
- Self-managed GitLab administrators: These installations are the only ones that need to take action. The advisory states the update is the only certain protection, and there is no interim workaround documented; administrators who patched on October 12 must verify their installed version and reapply the October 21 updates if necessary.
- GitLab.com users: No action required — GitLab.com already runs the fixed version according to the company.
- GitLab Dedicated tenants: Tenants on internal releases 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix applied, per GitLab's advisory.
Context from recent, related fixes reported by joaxcar
GitLab said this is the fourth code-execution flaw in its regular-expression engine reported by the same researcher who uses the handle joaxcar within roughly a month. On October 12 GitLab fixed CVE-2026-97229 — another unauthenticated overflow rated 10.0 — in versions 19.2.8, 19.3.5, and 19.4.2. On September 23 GitLab fixed two earlier flaws, CVE-2026-93577 and CVE-2026-89078, both rated 9.9 but requiring a logged-in account; those three earlier fixes did not extend earlier than version 19.2, while CVE-2026-110264 reaches back to releases beginning with 7.0.
GitLab's advisory leaves one firm practical conclusion: for self-managed instances, the patch is the only definitive defense, and administrators must plan the upgrade with attention to database migrations and the possibility that recent patches do not fully cover their installed branch. The company supplied Sigma-format detections to help hunt for exploitation, but without published preconditions the safest course is to install the October 21 fixes for any affected release.
