GITLAB has released fixes for a critical vulnerability, CVE-2026-110264, that could allow unauthenticated code execution on self-managed GitLab servers. The flaw stems from an integer overflow in Ruby’s Onigmo regular-expression compiler used by GitLab, which under certain conditions could let an attacker run arbitrary code on the server without logging in.
There are no confirmed exploits reported by GitLab as of 21 October 2026, and the issue is not listed in the US CISA Known Exploited Vulnerabilities catalogue as of 22 October.
The vulnerability affects every GitLab version going back to 7.0 (released in 2014). GitLab fixed seven versions in a single advisory and provided a clear upgrade path: 19.5 before 19.5.1 should move to 19.5.1; 19.4 before 19.4.3 to 19.4.3; 19.3 before 19.3.6 to 19.3.6; 19.2 before 19.2.9 to 19.2.9; 19.1 before 19.1.9 to 19.1.9; 19.0 before 19.0.10 to 19.0.10; and 7.0 through 18.11 before 18.11.13 to 18.11.13. Older branches (7.0–18.11) were patched by backporting to specific internal releases.
GitLab[.]com users were already on fixed code, and dedicated tenants on internal 19.3.5-internal0 or 19.4.2-internal0 or later were also protected. The advisory notes that the exact preconditions for exploitation are not disclosed, so administrators should assume the risk unless upgraded; detection rules named “Onigmo native worker crash” and “Org mode render error burst” have been published to aid monitoring.
The broader context notes this is the fourth code-execution flaw in GitLab’s Onigmo engine reported by the same researcher in a month. CVEs accompanying the October 21 release include CVE-2026-97229, CVE-2026-93577 and CVE-2026-89078, among others. Downtime considerations apply to some patches (notably 19.4.3 and 19.3.6) due to database changes during upgrade.