GitLab Patches CVSS 10 Pre-Auth RCE in Every Build Since 2014
TL;DR
- Shadowserver tracks 2,700+ GitLab CE instances exposed on the public internet, defining the opportunistic exploitation surface before any public PoC surfaces.
- The October 22 bundle patches 12 vulnerabilities total; administrators must triage 11 additional CVEs alongside the CVSS 10.0 critical.
- Mandatory PostgreSQL schema migrations in 19.4.3 and 19.3.6 mean single-node self-managed deployments face hours of downtime during remediation.
GitLab shipped out-of-band patches on October 21 for CVE-2026-110264, a preauth remote code execution flaw rated CVSS 10.0 that affects every self-managed release since GitLab 7.0 shipped in 2014.
The advisory, relayed by The Hacker News, says the bug stems from "an integer overflow during the compilation of a specially crafted regular expression" in Onigmo, the Ruby regex engine GitLab bundles. Fixed self-managed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. "GitLab.com already runs the fixed version, and GitLab Dedicated tenants on the internal releases 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix," the write-up notes, so only self-managed operators need to move.
This is the fourth code-execution flaw in GitLab's regular-expression engine that the same researcher, who uses the handle joaxcar, has reported in a month, with three prior reports on October 12 and September 23. GitLab has not described the preconditions for exploitation, has said nothing about active abuse, and the CVE is absent from CISA's known-exploited catalog as of October 22. "The fix is the only certain protection, and GitLab's advisory offers no interim workaround," the reporting adds.
It lands in a long run of cybersecurity coverage on our tracker, 213 stories in the last 90 days, and joaxcar's streak suggests the Onigmo attack surface in Ruby-backed products is still being worked.
What others are reporting
-
BleepingComputer Read →
Cites Shadowserver data showing 2,700+ exposed GitLab CE instances online, and contextualizes both CVEs from researcher joaxcar within a pattern of recent critical GitLab flaws.
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code.
-
CERT-EU Read →
EU governmental advisory issuing binding directives to member-state institutions and critical-infrastructure operators, elevating this beyond a vendor patch notice.
A critical integer overflow vulnerability within the regular expression compiler could allow an unauthenticated user to execute arbitrary code.
-
CyberSecurityNews Read →
Explicitly warns admins that the October 12 patch for CVE-2026-97229 does not cover this flaw; covers all 12 vulnerabilities in the October 22 bundle.
An integer overflow while compiling a specially crafted regular expression could allow an unauthenticated attacker to execute code on the GitLab server.
-
GBHackers on Security Read →
Provides full patch table for all 12 CVEs in the release, deployment downtime flags for database migrations, and GitLab's published threat detection signatures for self-managed admins.
This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition.
-
The CyberSec Guru Read →
Flags mandatory PostgreSQL schema migrations in 19.4.3 and 19.3.6 that cause hours of downtime on single-node setups, and explains the Ruby/Onigmo parser differential enabling validation bypass.
A carefully constructed string can get past high-level validation and land on the integer arithmetic that governs memory allocation inside the compiler.
-
CyberNewsAI Read →
Supplies Sigma, KQL, and SPL hunting queries for SOC deployment, maps exploitation to MITRE ATT&CK, and provides copy-paste remediation commands for omnibus and container environments.
An unauthenticated remote adversary can supply a specially crafted regular expression pattern to trigger an integer overflow during regex compilation.
Originally reported by thehackernews.com
Read the original article →Original headline: GitLab Patches CVSS 10.0 Pre-Auth RCE CVE-2026-110264 in Every Self-Managed Release Since 2014