cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

GitLab Fixes Critical Unauthenticated Code-Execution Flaw Affecting Releases Since 2014

· Original article ↗

Summary

GitLab fixed CVE-2026-110264, a maximum-severity flaw that could allow unauthenticated code execution on self-managed installations dating back to version 7.0. No exploitation has been reported; administrators should upgrade.

Key points

  • CVE-2026-110264 is rated CVSS 10.0 and could enable unauthenticated arbitrary code execution through an integer overflow in the Onigmo regular-expression compiler.
  • The flaw affects GitLab releases dating back to version 7.0, released in 2014; GitLab issued fixes across seven versions.
  • The October 12 update did not fix the flaw, so installations updated then may still need to upgrade.
  • GitLab says it has no evidence of exploitation, and the flaw was not listed in CISA's Known Exploited Vulnerabilities catalog as of October 22.
  • Only self-managed installations need to act; GitLab.com and specified GitLab Dedicated releases already include the fix.
  • GitLab published two Sigma-format detection rules for administrators, but says it has not disclosed the conditions required to reach the vulnerable compiler and offers no interim workaround.
  • Upgrades to 19.4.3 and 19.3.6 involve database changes and cause downtime on single-node servers; GitLab says multi-node deployments can use its zero-downtime procedure.

Article Details

Vulnerability Types
  • Integer overflow in regular-expression compilation
  • Unauthenticated remote code execution
Severity
Critical (CVSS 10.0)
Affected Versions
  • GitLab versions 7.0 and later
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-110264The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to anCVE-2026-89078in versions 19.2.8, 19.3.5, and 19.4.2. On September 23, it fixed two more, CVE-2026-93577 and CVE-2026-89078, both rated 9.9 but requiring a logged-in account. The three earlier flaws stopped at version 19.2;CVE-2026-93577in the regex compiler, in versions 19.2.8, 19.3.5, and 19.4.2. On September 23, it fixed two more, CVE-2026-93577 and CVE-2026-89078, both rated 9.9 but requiring a logged-in account. The three earlier flaws stoppedCVE-2026-97229On October 12, GitLab fixed CVE-2026-97229, also an unauthenticated 10.0 overflow in the regex compiler, in versions 19.2.8, 19.3.5, and 19.4.2. On September 23, it fixed two more, CVE-2026-93577 and CVE-2026-89078,

People

joaxcarResearcher credited with reporting this flaw and three other GitLab regular-expression-engine code-execution flaws in the prior month.

Vendors

GitLabGitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.

Products

GitLabGitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.Onigmoback is the part of GitLab that failed. The regular-expression compiler is Ruby's built-in engine, called Onigmo, which GitLab ships inside its own packages and patches in its own builds. A weakness in that engine is

Tools

TLDR framework"Onigmo native worker crash" and "Org mode render error burst." They are part of the company's open-source TLDR framework, which writes each detection in the Sigma format against GitLab's own application logs.

Related Articles