GitLab CVSS 10 flaw hits every release since 7.0; patch again

GitLab released seven patch versions on October 21 for CVE-2026-110264, a flaw rated 10.0, the top CVSS score. Under conditions GitLab has not described, an unauthenticated user could run code on a self-managed GitLab server through an integer overflow when it compiles a crafted regular expression. It affects every release from 7.0 on. If your company hosts its own GitLab, this is today’s upgrade.

The Hacker News reported it the same day. GitLab.com is already patched, GitLab says, and Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later already have the fix. Self-managed servers are the ones at risk.

The fourth regex flaw in a month

This did not come out of nowhere. GitLab’s own advisories show a run of bugs in how the server parses and compiles regular expressions:

• September 23: two flaws rated 9.9, CVE-2026-89078 and CVE-2026-93577, both needing a logged-in user and a crafted regex in CI/CD configuration.
• October 12: CVE-2026-97229, rated 10.0 and needing no login, fixed in 19.4.2, 19.3.5 and 19.2.8.
• October 21: CVE-2026-110264, also 10.0 with no login, and the first that reaches back past 19.2.

That last point is the trap. The earlier three only affected 19.2 and newer, so a server on an older line had nothing to patch. This one hits everything back to 7.0, which The Hacker News notes came out in 2014. And a server patched on October 12 is still exposed: 19.4.2 is older than 19.4.3.

The same researcher, joaxcar, is credited on the HackerOne report, and The Hacker News counts four such flaws from that person in a month. The October 21 release also ships a “Ruby regexp repeat ID overflow patch,” per GitLab’s list of changes, which fits The Hacker News’s account that the root cause sits in Onigmo, the regex engine Ruby uses.

Why GitLab patched seven lines, not three

GitLab’s maintenance policy backports security fixes to the current release and the previous two, which would mean 19.5, 19.4 and 19.3. This time it also shipped 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The policy allows that only “in rare cases.” We read the extra four lines as GitLab’s own signal of how serious it thinks this is.

GitLab says nothing about attacks so far. When we checked CISA’s known exploited vulnerabilities catalog at 05:38 UTC on October 22, this CVE was not on it. The same catalog shows why old servers matter, though: in February 2026 CISA added two GitLab flaws from 2021, CVE-2021-39935 and CVE-2021-22175, which means attackers were still using five-year-old bugs.

What to do now

1. Find your version. Sign in, then open Help > Help; the version shows at the top.
2. Upgrade to the fix for your line: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab gives no workaround.
3. Plan for downtime on a single server. GitLab says the patch “will cause downtime during the upgrade as migrations must complete before GitLab can start.” Multi-node setups can use the zero-downtime procedure.
4. On 18.10 or older, budget more than one step. You cannot skip required upgrade stops such as 18.2, 18.5, 18.8 and 18.11, and each needs background migrations to finish. GitLab’s upgrade path tool lists the stops from your version. If that takes days, consider taking the server off the public internet until you are done.
5. Turn on the detections. GitLab published two rules, “Onigmo native worker crash” and “Org mode render error burst,” in its open TLDR detection repository. If you use SAML with LDAP auto-linking, the same release fixes an account takeover rated 8.2, CVE-2026-15723.

Sources

• GitLab, Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, October 21, 2026: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
• GitLab, Critical Patch Release 19.4.2, 19.3.5, 19.2.8, October 12, 2026: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
• GitLab, Critical Patch Release 19.4.1, 19.3.3, 19.2.7, September 23, 2026: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/
• NVD, CVE-2026-110264: https://nvd.nist.gov/vuln/detail/CVE-2026-110264
• The Hacker News, “Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases,” October 21, 2026: https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
• GitLab, maintenance policy: https://docs.gitlab.com/policy/maintenance/
• GitLab, upgrade paths: https://docs.gitlab.com/update/upgrade_paths/
• GitLab, find your GitLab version: https://docs.gitlab.com/user/version/
• CISA, Known Exploited Vulnerabilities Catalog, read October 22, 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog