Integer overflow in Onigmo regex engine allows unauthenticated RCE
Integer overflow in GitLab's bundled Onigmo regex engine enables unauthenticated RCE on self-managed servers running versions 7.0 through 19.5.
- Vendor
- GitLab
- Product
- GitLab CE/EE
- CVSS
- 10.0
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-110264 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-110264 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-23 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 22, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-23. Full cross-catalog view: /kev-comparison
CVE-2026-110264 timeline
- Patch available-1d (before NVD)Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Overview
CVE-2026-110264 is a critical-severity integer overflow in the Onigmo regular expression library bundled with GitLab CE and EE. Because GitLab exposes regex evaluation to unauthenticated HTTP requests in several search and API paths, a remote attacker can craft a malicious pattern that triggers the overflow, corrupts heap memory, and executes arbitrary code as the GitLab Rails process — without any credentials or prior account access.
The National Vulnerability Database rates the vulnerability CVSS 3.1: 10.0 (Critical). GitLab disclosed it on 2026-10-21 alongside patched builds.
Affected Versions
All self-managed GitLab CE and EE installations from version 7.0 through 19.5.0 are affected. GitLab.com (SaaS) was patched by GitLab before disclosure.
Patched Releases
GitLab released fixes across all supported stable branches on 2026-10-21:
| Branch | Fixed version |
|---|---|
| 19.5 | 19.5.1 |
| 19.4 | 19.4.3 |
| 19.3 | 19.3.6 |
| 19.2 | 19.2.9 |
| 19.1 | 19.1.9 |
| 19.0 | 19.0.10 |
| 18.11 | 18.11.13 |
Administrators running any older branch (18.10 and below) should upgrade to a supported release as no backport patches are available for end-of-life versions.
Recommended Actions
- Upgrade immediately. Apply the patched release for your branch. Verify the installed version with
gitlab-rake gitlab:env:info. - No known workaround exists that fully mitigates the unauthenticated vector. Blocking public access to the
/searchand API endpoints can reduce exposure on internet-facing instances until the upgrade is complete. - Check for indicators of compromise — unusual Rails exceptions, unexpected process spawns from the Puma worker, or anomalous outbound connections from the GitLab server.
KEV Status
As of 2026-10-22, CISA has not added CVE-2026-110264 to the Known Exploited Vulnerabilities catalog. Given the CVSS 10.0 score and unauthenticated vector, organizations should treat this as a high-priority patch regardless of KEV listing. Monitor CISA KEV for updates.
References
Other GitLab CE/EE CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-97229 GitLab CI/CD regex integer overflow enables unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 0.5% | — |
| CVE-2026-85706 GitLab Path Traversal Allows Unauthenticated File Readwrite-up | [ CRITICAL ] | 10.0 | 92.0% | |
| CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control Vulnerability | [ CRITICAL ] | 10.0 | 94.5% | |
| CVE-2021-22205 GitLab CE/EE ExifTool Remote Code Executionransomware usewrite-up | [ CRITICAL ] | 9.9 | 99.7% |
