GitLab Patches a CVSS 10.0 Regex Flaw That Reaches Back to 2014, the Fourth Code-Execution Bug in Its Engine This Month

GitLab pushed a critical patch release on October 21 that closes 11 security issues, one of which it rates at the top of the scale: CVE-2026-110264, a CVSS 10.0 flaw that, in the vendor words, could have allowed an unauthenticated user to execute arbitrary code on a GitLab server under certain conditions. The bug is an integer overflow triggered while the server compiles a specially crafted regular expression. GitLab has not published what those conditions are, and it offers no workaround — the patch is the only certain protection.

The scope is what makes this one uncomfortable. The flaw lives in Onigmo, the regular expression compiler bundled with Ruby that GitLab packages and patches in its own builds, and it has shipped in every self-managed GitLab release since 7.0 in 2014. Fixes landed across seven branches at once — 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 — and four of those are backports below the line GitLab normally supports, a step it reserves for severe issues.

There is also a patch trap for anyone who upgraded recently. On October 12 GitLab fixed CVE-2026-97229, another unauthenticated 10.0 overflow in the same compiler on the CI/CD path, but only in 19.2.8, 19.3.5 and 19.4.2. The new fixed versions sit one patch above those, so an instance brought fully current nine days ago falls back into scope. The check that matters is the exact installed version, not the upgrade date.

The pattern behind the release is notable: this is the fourth code-execution bug in the regex engine reported in a month by the same researcher, who reports under the handle joaxcar through the HackerOne bug bounty program. On September 23 GitLab fixed CVE-2026-93577 and CVE-2026-89078, both CVSS 9.9 but requiring a logged-in account; October 12 brought CVE-2026-97229; this one is the first to reach versions before 19.2. GitLab published two Sigma detection rules for self-managed operators, Onigmo native worker crash and Org mode render error burst, but warns that a successful exploit does not reliably crash the worker — a clean log proves nothing.

The operational status as of October 22: GitLab says it has seen no evidence of exploitation and the CVE is not yet in the CISA Known Exploited Vulnerabilities catalog. GitLab.com already runs the patched build, and GitLab Dedicated tenants on the relevant internal releases are covered; only self-managed installs need to act. Two more issues in the same release deserve attention — CVE-2026-15723, an 8.2 account takeover possible where an administrator enabled both SAML and LDAP auto-linking, and CVE-2026-112212, a 7.5 cache-poisoning flaw in the OAuth and OpenID Connect endpoints. Versions 19.4.3 and 19.3.6 also carry database migrations, so single-node servers should plan for downtime during the upgrade.

The AI-era context is not decoration. Coding agents are pumping more commits, merge requests and pipelines into self-hosted GitLab instances than ever, and those servers hold source code, deployment credentials and access tokens — crown-jewel targets where an unauthenticated entry point does not need a stolen password. Inventory every instance, including the internal dev boxes nobody calls production, verify the exact version against the seven fixed releases, and do not assume last week's upgrade covered this.