GitLab patches CVSS 10.0 flaw allowing unauthenticated remote code execution

Vulnerability Details

A critical vulnerability tracked as CVE-2026-110264 has been assigned the maximum CVSS score of 10.0. GitLab states that, under certain conditions, an unauthenticated user can run arbitrary code on the server, and it has not said what those conditions are. The issue stems from an integer overflow that occurs during the compilation of a specially crafted regular expression. This is the fourth code execution flaw in GitLab's regular expression engine reported by researcher joaxcar within a month. The first three flaws stopped at version 19.2; this one does not.

Affected Versions and Fix

The flaw affects every version of GitLab going back to 7.0, released in 2014, making self-managed installations across twelve years of releases potentially vulnerable. GitLab released fixes on October 21 for seven version branches. The company backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 on top of its standard release schedule, a step reserved for severe issues. Normally GitLab's policy covers the current release and the previous two monthly releases, currently 19.5, 19.4 and 19.3. The fixed versions for each branch are 19.5.1 for 19.5, 19.4.3 for 19.4, 19.3.6 for 19.3, 19.2.9 for 19.2, 19.1.9 for 19.1, 19.0.10 for 19.0 and 18.11.13 for the 7.0 through 18.11 series. GitLab.com already runs the fixed version, and GitLab Dedicated tenants on internal releases 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix.

Upgrade and Mitigation

The fix matters even for administrators who patched nine days earlier. The October 12 update fixed CVE-2026-97229, also an unauthenticated 10.0 overflow in the regex compiler, in versions 19.2.8, 19.3.5 and 19.4.2. The new fixed versions sit one patch above, so an instance updated then is in range again. GitLab reports no sign the flaw has been used in attacks, and it is not listed in the U.S. CISA catalog of known exploited vulnerabilities as of October 22. The October 21 release fixes 11 security issues in all, one critical and the rest high, medium or low. Two of the others concern authentication: CVE-2026-15723, rated high at 8.2, could allow a logged-in user to take over another account when both SAML and LDAP auto-linking are enabled, and CVE-2026-112212, rated high at 7.5, is a cache-poisoning flaw in OAuth and OpenID Connect endpoints in setups that use a shared cache. GitLab has not said what preconditions an attacker needs to reach the compiler, so administrators cannot yet rule themselves out by configuration. The advisory offers no interim workaround and the fix is the only certain protection. GitLab also published two Sigma-format detection rules, "Onigmo native worker crash" and "Org mode render error burst", to help administrators look for exploitation attempts. On single-node servers the upgrade to 19.4.3 or 19.3.6 involves database changes that cause downtime while they finish, while multi-node setups can apply the patch using GitLab's zero-downtime procedure.

Earlier coverage: GitLab warns of maximum severity code execution vulnerability

Sources: The Hacker News