GitLab has released urgent security patches to address a maximum-severity, unauthenticated remote code execution vulnerability impacting virtually every self-managed version of its software released over the past twelve years, dating all the way back to version 7.0 introduced in 2014.
Tracked as CVE-2026-110264 and assigned a maximum CVSS score of 10.0, the vulnerability arises from an integer overflow triggered during the compilation of a specially crafted regular expression. Under specific conditions, this flaw enables an unauthenticated attacker to execute arbitrary code directly on a targeted self-managed GitLab server without requiring any prior login credentials.
The security update carries critical implications even for system administrators who proactively applied patches just days prior. An earlier security advisory issued on October 12 covered only versions 19.2 and later. Because the newly released fixed versions sit one patch level above those previous updates, instances that were patched during the earlier cycle are once again exposed and require an immediate secondary upgrade.
GitLab has emphasized that only self-managed installations need to take action. Cloud-hosted environments on GitLab.com already run the patched software, and GitLab Dedicated tenants utilizing internal releases 19.3.5-internal0, 19.4.2-internal0, or later versions are inherently protected. However, for organizations hosting their own infrastructure, the vulnerability presents a severe risk because GitLab has not yet publicly disclosed the precise environmental conditions required for successful exploitation. Furthermore, the company reports no indication that the vulnerability has been actively exploited in the wild, and as of October 22, it does not appear on the U.S. Cybersecurity and Infrastructure Security Agency catalog of known exploited vulnerabilities.
To address the flaw across its active and legacy product lines, GitLab executed an unusual move by backporting the fix into seven distinct version branches simultaneously. Normally, the company’s formal security support policy strictly covers the current monthly release along with the previous two monthly releases—which currently comprise versions 19.5, 19.4, and 19.3. Recognizing the severe nature of CVE-2026-110264, GitLab extended exceptional support by issuing dedicated patches for older legacy branches, including versions 18.11, 19.0, 19.1, and 19.2.
Self-managed administrators running affected software branches must apply the corresponding updates immediately. Organizations utilizing the 19.5 branch prior to version 19.5.1 must upgrade to version 19.5.1. Those operating on the 19.4 branch before 19.4.3 need to update to version 19.4.3, while users on the 19.3 branch prior to 19.3.6 must transition to version 19.3.6. For slightly older environments, administrators on version 19.2 must upgrade to 19.2.9, those on 19.1 must move to 19.1.9, and users operating on version 19.0 must update to 19.0.10. Finally, organizations running any long-standing legacy installation spanning from version 7.0 through version 18.11 must apply the backported fix by upgrading to version 18.11.13.
The remarkable historical reach of the vulnerability—spanning nearly twelve years of software development—stems from the specific software component where the failure occurs. The regular-expression compiler responsible for the flaw is Ruby’s built-in engine, known as Onigmo. GitLab packages this engine directly within its own software distribution builds and handles internal patching. Consequently, any underlying vulnerability within the Onigmo engine is naturally present in every GitLab release shipped since version 7.0.
Because GitLab has not yet revealed the precise preconditions required for an attacker to reach the vulnerable compiler, system administrators cannot currently rule out their exposure through configuration adjustments or defensive hardening. Consequently, applying the official software updates remains the sole verified method of protection, as the vendor’s security advisory provides no interim workarounds.
To assist security teams in monitoring their networks, GitLab has published two specific detection rules designed to help self-managed administrators identify potential exploitation attempts. Titled "Onigmo native worker crash" and "Org mode render error burst," these rules form part of the company’s open-source TLDR framework. The framework writes each detection mechanism in the Sigma format, tailored directly against GitLab’s native application logs.
This critical vulnerability marks the fourth code-execution flaw tied to GitLab’s regular-expression engine to be discovered and reported by the same security researcher, who operates under the handle joaxcar, within a single month. It is also the first of these discoveries to impact software versions older than 19.2.
The security landscape surrounding GitLab’s regex engine has grown increasingly tense over recent weeks. On October 12, GitLab patched CVE-2026-97229, another unauthenticated CVSS 10.0 integer overflow vulnerability in the regex compiler, addressing it within versions 19.2.8, 19.3.5, and 19.4.2. Prior to that, on September 23, the company patched two additional regex-related flaws tracked as CVE-2026-93577 and CVE-2026-89078. Both of those earlier vulnerabilities carried a high CVSS rating of 9.9, though they required an attacker to maintain an authenticated user account. While those three preceding vulnerabilities were restricted to version branches 19.2 and newer, the latest discovery extends its reach deep into legacy architectures.
Alongside the critical remote code execution patch, GitLab’s October 21 security release bundles fixes for ten additional security vulnerabilities, spanning high, medium, and low severity ratings. Among these supplementary updates are two notable authentication-related issues. The first, tracked as CVE-2026-15723 and rated 8.2 on the CVSS scale, could potentially allow an authenticated user to hijack another user’s account, though this scenario is strictly limited to instances where an administrator has explicitly enabled both SAML and LDAP auto-linking configurations.
The second auxiliary issue, identified as CVE-2026-112212 with a CVSS score of 7.5, involves a cache-poisoning vulnerability residing within GitLab’s OAuth and OpenID Connect endpoints. Under specific deployment setups that rely on a shared caching mechanism, this flaw could enable a malicious actor to redirect certain authentication sign-in flows to an external server under their administrative control.
Organizations planning their upgrade schedules must also account for operational costs associated with the deployment. Specifically, upgrades to versions 19.4.3 and 19.3.6 incorporate critical database migrations that execute during the installation process. For single-node server deployments, this requirement entails noticeable downtime while the database updates complete. Conversely, GitLab notes that multi-node enterprise setups can apply the necessary patches without experiencing service interruptions by following its standardized zero-downtime upgrade procedures.
