GitLab CVSS 10.0 Regex Flaw Hits 12 Years of Releases

Unauthenticated RCE. CVSS 10.0. Every self-managed GitLab release back to version 7.0, released in 2014.

CVE-2026-110264 is an integer overflow in Onigmo, the Ruby regular expression engine bundled in GitLab across those twelve years. A specially crafted regex input triggers the overflow and runs attacker-controlled code on the server. No authentication required. GitLab disclosed and patched the flaw on October 21, 2026. Confirmed.

Scope is self-managed instances only. GitLab.com and Dedicated tenants are already protected by GitLab before this disclosure.

Patches are available in seven supported branches: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Versions outside those branches are on unsupported releases and require a branch upgrade before the fix applies.

Exploitation status: no confirmed in-the-wild activity as of October 22. Not listed in CISA’s KEV catalog. Analysis: a CVSS 10.0 unauthenticated code execution flaw in a platform that holds source code and CI/CD pipeline secrets is exactly the kind of vulnerability targeted intrusion operations prioritize. Exploitation attempts within days are plausible.

Context: a related flaw, CVE-2026-97229, was patched October 12 covering only versions 19.2 and later. That release left older supported branches exposed. October 21’s emergency update backports the full fix across all maintained releases.

Unpatched self-managed instances have no confirmed mitigations short of network isolation. The fixed releases are available now.