GitLab · 2026-10-21 · major
GitLab CVE-2026-110264 — CVSS 10.0 RCE flaw spans 12 years of releases
GitLab fixed CVE-2026-110264 (CVSS 10.0), an integer overflow in its regex engine that allows unauthenticated RCE on self-managed servers running any version since 7.0 (2014). No workaround exists; upgrade to 19.5.1, 19.4.3, or 18.11.13.
CVE-2026-110264 (CVSS 10.0) is an integer overflow in GitLab's bundled regex engine that allows unauthenticated code execution on self-managed servers.
Quick facts
| CVE | CVE-2026-110264 |
|---|---|
| CVSS Score | 10.0 (Critical) |
| Impact | Unauthenticated remote code execution |
| Affected versions | 7.0 through 19.4.2 (all releases since 2014) |
| Fixed in | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 |
| Workaround | None — upgrade required |
| Disclosed | October 21, 2026 |
What is it?
CVE-2026-110264 is a CVSS 10.0 integer overflow in Onigmo, the Ruby regex engine that GitLab bundles and patches in its own packages. An unauthenticated attacker can exploit it to execute arbitrary code on any unpatched self-managed GitLab server. GitLab shipped patched releases on October 21, 2026, covering every supported branch back to 18.11.
How does it work?
The flaw sits in Onigmo's regular-expression compiler. Compiling a specially crafted pattern triggers an integer overflow that corrupts adjacent memory, opening a code-execution path before any authentication check runs. GitLab has not published the exact preconditions, but the maximum CVSS score indicates no authentication or user interaction is required to reach the vulnerable code path.
Why does it matter?
Every self-managed GitLab instance from version 7.0 (released 2014) through 19.4.2 is exposed — roughly 12 years of releases. There is no configuration workaround: the only fix is upgrading. GitLab.com and Dedicated tenants are already patched and need no action; the risk falls entirely on self-managed operators.
Who is it for?
GitLab self-managed administrators
Frequently asked questions
- Which GitLab versions are affected by CVE-2026-110264?
- CVE-2026-110264 affects all self-managed GitLab versions from 7.0 through 19.4.2 — every release for the past 12 years. Patched versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later are already patched.
- What can an attacker do with CVE-2026-110264?
- An unauthenticated attacker who exploits CVE-2026-110264 can run arbitrary code on the GitLab server with the permissions of the GitLab process. This gives full access to hosted repositories, CI/CD pipelines, stored secrets, and any other data on the server — no account or credentials required.
- Is there a workaround if I cannot upgrade GitLab right away?
- No. GitLab has not published a configuration-level workaround for CVE-2026-110264. The only remediation is upgrading to a patched release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13, depending on which branch you run. Note that 19.4.3 and 19.3.6 include database migrations that cause downtime on single-node servers.
- Has CVE-2026-110264 been exploited in the wild?
- As of October 22, 2026, no in-the-wild exploitation of CVE-2026-110264 has been reported and it is not listed on CISA's Known Exploited Vulnerabilities catalog. Given the maximum CVSS score and lack of any workaround, administrators should treat this as urgent and upgrade immediately.
Try it
Upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13