A crafted regex runs code on every GitLab since 2014

GitLab shipped fixes on October 21 for CVE-2026-110264, an unauthenticated remote code execution flaw it rates 10.0 on CVSS, the maximum. It affects every version of the self-managed software back to 7.0, which shipped in 2014.

The bug is in the regular-expression compiler. GitLab says that under certain conditions an unauthenticated user can force an integer overflow while the server compiles a specially crafted regex, and run arbitrary code as a result. The company has not said what those conditions are. Without the preconditions, you cannot inspect your own configuration and rule yourself out. The advisory ships no workaround, so the patch is the only certain protection.

The reason it reaches back twelve years is the component that broke. The regex engine is Onigmo, Ruby’s built-in compiler, which GitLab bundles inside its own packages and patches in its own builds. The weakness is present wherever that engine has shipped, and it has shipped in every GitLab release since 7.0.

If you patched on October 12, you are back in scope. That update went only to 19.2 and later, and the new fixed versions sit one patch above it, so an instance brought current nine days ago falls in range again. GitLab fixed the flaw in seven releases at once: three standard branches, 19.5, 19.4.3 and 19.3.6, plus backports to 18.11.13, 19.0.10, 19.1.9, and 19.2.9. Four of those sit older than GitLab normally touches; its policy covers the current release and the previous two monthly ones, 19.5, 19.4 and 19.3 as of today. Backporting below that line is something the company reserves for severe issues.

Only self-managed installs need to act. GitLab.com already runs the fixed build, and GitLab Dedicated tenants on internal releases 19.3.5-internal0 and 19.4.2-internal0 or later are covered. GitLab reports no sign the flaw has been exploited, and it is not in CISA’s known-exploited catalog as of October 22.

For anyone who wants to hunt rather than wait, GitLab published two detection rules, “Onigmo native worker crash” and “Org mode render error burst.” Both are part of its open-source TLDR framework, written in Sigma against GitLab’s own application logs.

This is the fourth code-execution bug in GitLab’s regex engine reported in a month by a researcher using the handle joaxcar, and the first to reach versions before 19.2. On October 12 GitLab fixed CVE-2026-97229, also an unauthenticated 10.0 overflow in the same compiler, in 19.2.8, 19.3.5 and 19.4.2. On September 23 it fixed CVE-2026-93577 and CVE-2026-89078, both 9.9 but requiring a logged-in account. The earlier three stopped at 19.2; this one reaches back to 7.0.

The October 21 release closes 11 security issues in total, one critical and the rest high, medium or low. Two concern authentication. CVE-2026-15723, rated 8.2, lets a logged-in user take over another account, but only where an administrator has turned on both SAML and LDAP auto-linking. CVE-2026-112212, rated 7.5, is a cache-poisoning flaw in the OAuth and OpenID Connect endpoints that can redirect certain sign-in flows to an attacker-controlled server in setups backed by a shared cache.

Plan for the upgrade rather than running it blind. The 19.4.3 and 19.3.6 releases carry database changes that run during the upgrade, and on a single-node server that means downtime while they complete. Multi-node setups can apply the patch without downtime using GitLab’s zero-downtime procedure.