GitLab, the developer operations platform company, released an emergency security patch on October 21 fixing 12 vulnerabilities in its products. One of them could allow an unauthenticated attacker to execute arbitrary code on the server, earning the maximum score of 10.0 on the 10-point Common Vulnerability Scoring System (CVSS) and the most severe "Critical" severity rating. The CVSS 3.1 vector is "AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H," indicating network-based access, low attack complexity, no authentication required, and no user interaction, with high impact not only on GitLab itself but on confidentiality, integrity, and availability alike. The affected range extends to version 7.0, released in 2014 — an extraordinary situation covering 12 years of releases.
The vulnerability in question is identified as "CVE-2026-110264." According to GitLab, under certain conditions, compiling a specially crafted regular expression triggers an integer overflow, potentially allowing a user who is not logged in to execute arbitrary code on the server. The company has not disclosed the specific attack conditions. The flaw was reported by joaxcar through the bug bounty program "HackerOne." Over the past month, joaxcar has reported four code-execution vulnerabilities involving GitLab's regular expression engine, and this is the first case to reach branches earlier than version 19.2.
The patched versions released this time are seven branches: "19.5.1," "19.4.3," "19.3.6," "19.2.9," "19.1.9," "19.0.10," and "18.11.13." GitLab's normal support policy is limited to the current version and the two most recent monthly releases (currently 19.5, 19.4, and 19.3), but backports reserved for severe issues were also applied to 18.11.13, 19.0.10, 19.1.9, and 19.2.9.
Of note is that environments that already applied the fix nine days earlier, on October 12, are affected again. The previous update covered version 19.2 and later, and the new patched versions sit one level above that, so instances patched at that time fall within the affected range once more. Administrators must update again.
Behind the wide reach of the vulnerability is a weakness in "Onigmo," the Ruby regular expression engine that GitLab bundles internally and modifies with its own build. Every release that has shipped this engine — that is, everything since 7.0 — has been potentially affected. GitLab says no signs of exploitation have been confirmed, and as of October 22 the flaw was not listed in the "Known Exploited Vulnerabilities Catalog" published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Only self-managed instances require action. GitLab.com is already running the patched versions, and GitLab Dedicated tenants are fixed if they are on internal releases "19.3.5-internal0" or "19.4.2-internal0" or later. GitLab has not offered a temporary workaround, and the preconditions required for an attack are undisclosed, so administrators cannot exclude the impact through configuration. Applying the patch is the only reliable defense.
A total of 12 issues are fixed in this release: one Critical, two High, five Medium, and four Low. Of the two high-risk issues, "CVE-2026-15723" (CVSS 8.2) could allow a logged-in user to take over another account, but only when an administrator has enabled both SAML and LDAP automatic linking. Cache poisoning in the OAuth and OpenID Connect endpoints (CVE-2026-112212, CVSS 7.5) could, in configurations using a shared cache, redirect the authentication flow to a server controlled by an attacker.
GitLab also published detection rules for its application logs, "Onigmo native worker crash" and "Org mode render error burst," so self-managed administrators can detect attempted exploitation. They are provided in Sigma format as part of the open-source detection framework "TLDR."
Updating carries a cost. Versions 19.4.3 and 19.3.6 include database changes that run during the upgrade, causing downtime on single-node servers until processing completes. GitLab says multi-node configurations can apply the update without interruption using a zero-downtime procedure.
This comes just after GitLab addressed 24 issues on October 12, including "CVE-2026-97229," a CVSS 10.0 vulnerability allowing unauthenticated code execution. On September 23, it fixed two CVSS 9.9 vulnerabilities (CVE-2026-93577 and CVE-2026-89078) that required a logged-in account. A series of flaws originating in the regular expression engine were found in a short span, once again highlighting the difficulty of managing risk in the developer tool supply chain.
GitLab is deeply embedded in corporate in-house systems as the development foundation for continuous integration (CI) and source code management, and a compromise could lead to access to source code, credentials, and build artifacts. Information systems departments at companies with self-managed environments are urged to migrate promptly to the patched versions and to monitor logs using the detection rules. The running version can be checked after logging in by selecting "Help" then "Help" at the bottom of the left sidebar.
