Article
GitLab CVE-2026-110264: Am I Affected and What to Do in the Next Hour
GitLab CVE-2026-110264 (CVSS 10.0) allows unauthenticated code execution on self-managed servers. See affected versions, fixes and what to check.
Read more
Exploited vulnerability
GitLab regular expression compiler remote code execution (CVE-2026-110264)
A critical integer overflow in the regular expression compiler of GitLab Community Edition and Enterprise Edition.
- CVE ID
- CVE-2026-110264
- CVSS
- 10.0 Critical (CVSS v3.1, GitLab)
- Affected product
- GitLab Community Edition and Enterprise Edition (self-managed)
- Exploited
- Unknown
- Published
- October 2026
In short
CVE-2026-110264 is a critical integer overflow in the regular expression compiler of GitLab Community Edition and Enterprise Edition. GitLab says that under certain conditions an unauthenticated user could run arbitrary code on the GitLab server. It is rated CVSS 10.0 and affects every self-managed version from 7.0 until the fixed releases published on 21 October 2026.
- CVECVE-2026-110264
- ProductGitLab GitLab Community Edition and Enterprise Edition (self-managed)
- Fix Steps5actions listedFind your version · Follow required upgrade stops
What it allows
GitLab says that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server due to an integer overflow when compiling a specially crafted regular expression. The CVSS vector is network, low complexity, no privileges, no user interaction and a changed scope, with high impact on confidentiality, integrity and availability.
GitLab has not published a technical description. The release page names two detections, "Onigmo native worker crash" and "Org mode render error burst", but does not say how the attack works. GitLab makes issue details public 90 days after a release. The bug fix lists for 19.5.1, 19.4.3, 19.3.6 and 19.2.9 each include an entry about a Ruby regular expression overflow patch, which GitLab does not link to this CVE.
A GitLab server holds source code, CI variables and deployment keys, so code execution on it can reach every system built from that code.
In Brandefense's dark web and Telegram monitoring, we found nine posts naming this CVE between 21 and 22 October 2026. All repeat the advisory or news coverage. None offers a working exploit or access for sale. GitHub search metadata showed no repository for the CVE id at our first check on 22 October. A repository named as a proof of concept was created at 08:31 UTC (11:31 Turkey time) and held no files at our check at 08:49 UTC. We did not open any exploit code.
Who is affected
GitLab CE and EE, all deployment types, in these ranges: all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. Fixed in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1.
Servers patched on 12 October to 19.4.2, 19.3.5 or 19.2.8 are still affected. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action. The CVE record names no fix for branches older than 18.11, so those installs need an upgrade to 18.11.13 or later.
Timeline
- 12 Oct 2026
GitLab fixes an earlier critical flaw, CVE-2026-97229, in the CI/CD regular expression compiler (19.4.2, 19.3.5, 19.2.8).
- 13 Oct 2026
The CVE record shows that the identifier CVE-2026-110264 was reserved on this date.
- 21 Oct 2026
GitLab releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 and publishes two threat detections.
- 22 Oct 2026
The CVE record is published at 00:33 UTC and the NVD entry follows, still awaiting analysis.
What to do
-
Find your version
Sign in, open Help at the bottom of the left sidebar and read the version at the top. Do this for every self-managed GitLab, including test and old servers.
-
Patch internet-facing servers first
Move to the fixed version for your branch, for example 19.4.2 to 19.4.3. GitLab advises using the latest patch release of your minor version.
-
Follow required upgrade stops
On 18.10 or older, use the required stops listed in GitLab's upgrade path guide (on GitLab 18: 18.2, 18.5, 18.8, 18.11; older versions have their own stops) and end on 18.11.13 or later.
-
Check for abuse
Review the two GitLab detections. For the October 12 flaw Rapid7 pointed to Workhorse log requests to the CI lint API that end in HTTP 502, and to crashing Puma workers. Treat a match as a compromise.
-
Rotate secrets if you find a match
Rotate CI variables, tokens and deploy keys, and rebuild the server from a known good image.
Questions
What is CVE-2026-110264?
It is a critical flaw in GitLab's regular expression compiler. An integer overflow could let an unauthenticated user run code on a self-managed GitLab server. GitLab rates it CVSS 10.0.
Which GitLab versions are affected?
All versions from 7.0 before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1, depending on branch. GitLab.com is already patched.
Does the 12 October patch fix it?
No. The 12 October releases (19.4.2, 19.3.5, 19.2.8) fixed CVE-2026-97229, a different flaw. They are still affected by this one.
Is CVE-2026-110264 exploited?
GitLab reports no exploitation, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog as of 22 October 2026. We found no public exploit reports in our data. A public GitHub repository named as a proof of concept was created at 08:31 UTC (11:31 Turkey time) on 22 October, but at our check at 08:49 UTC it held no files.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 57 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 41 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 56 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 106 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.