GitLab Patches CVSS 10.0 RCE Flaw Affecting Self-Managed CE and EE
Summary
GitLab patched CVE-2026-110264, an unauthenticated RCE flaw caused by an integer overflow in regular-expression compilation. It affects self-managed CE and EE; no in-the-wild exploitation or public PoC has been confirmed.
Key points
- The flaw can allow unauthenticated arbitrary code execution when GitLab compiles a specially crafted regular expression.
- Affected code dates to GitLab 7.0, but the article says there is no evidence of exploitation throughout that period.
- Fixed releases include 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1.
- GitLab has not disclosed the complete exploitation path, and no public proof of concept or confirmed real-world exploitation is reported.
- GitLab published two detection names: “Onigmo native worker crash” and “Org mode render error burst”; these do not by themselves confirm compromise.
- Administrators are advised to upgrade, review historical application and endpoint telemetry, and investigate suspicious processes, configuration changes, and outbound connections.
Article Details
- Vulnerability Types
- Integer overflow in the regular-expression compiler, which can lead to unauthenticated remote code execution
- Severity
- Critical; CVSS v3.1 score 10.0
- Affected Versions
- GitLab CE and EE 7.0 through versions before 18.11.13
- GitLab CE and EE 19.0 before 19.0.10
- GitLab CE and EE 19.1 before 19.1.9
- GitLab CE and EE 19.2 before 19.2.9
- GitLab CE and EE 19.3 before 19.3.6
- GitLab CE and EE 19.4 before 19.4.3
- GitLab CE and EE 19.5 before 19.5.1
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-110264GitLab has released urgent security updates addressing CVE-2026-110264, a maximum-severity vulnerability that could allow an unauthenticated attacker to execute arbitrary code on vulnerable self-managed GitLab servers.CVE-2026-97229This vulnerability should also not be confused with CVE-2026-97229, another critical GitLab remote code execution flaw related to regular-expression processing that was patched earlier in October.