GitLab Patches CVSS 10 Pre-Auth RCE in Every Build Since 2014

GitLab shipped out-of-band patches on October 21 for CVE-2026-110264, a preauth remote code execution flaw rated CVSS 10.0 that affects every self-managed release since GitLab 7.0 shipped in 2014.

The advisory, relayed by The Hacker News, says the bug stems from "an integer overflow during the compilation of a specially crafted regular expression" in Onigmo, the Ruby regex engine GitLab bundles. Fixed self-managed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. "GitLab.com already runs the fixed version, and GitLab Dedicated tenants on the internal releases 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix," the write-up notes, so only self-managed operators need to move.

This is the fourth code-execution flaw in GitLab's regular-expression engine that the same researcher, who uses the handle joaxcar, has reported in a month, with three prior reports on October 12 and September 23. GitLab has not described the preconditions for exploitation, has said nothing about active abuse, and the CVE is absent from CISA's known-exploited catalog as of October 22. "The fix is the only certain protection, and GitLab's advisory offers no interim workaround," the reporting adds.

It lands in a long run of cybersecurity coverage on our tracker, 213 stories in the last 90 days, and joaxcar's streak suggests the Onigmo attack surface in Ruby-backed products is still being worked.