GitLab has released security updates to fix a critical vulnerability rated CVSS 10.0 that could allow unauthenticated attackers to execute arbitrary code on vulnerable self-managed servers.
Tracked as CVE-2026-110264, the flaw affects GitLab Community Edition (CE) and Enterprise Edition (EE), with affected releases dating back to GitLab 7.0, released in 2014.
The vulnerability stems from an integer overflow in the Onigmo regular expression engine used by GitLab when compiling specially crafted regular expressions. Under certain conditions, attackers could exploit the issue without authentication, potentially gaining the ability to execute code on a vulnerable server. Such access could put source code, development infrastructure, and connected systems at risk.
GitLab released patches on October 21, 2026, and recommends that administrators upgrade their installations as soon as possible. The issue affects multiple release branches, including older versions that are no longer covered by the platform’s standard maintenance window.
The fixed versions include GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Administrators should choose the appropriate patched release for their installation and follow the official upgrade instructions.
GitLab.com has already been updated, while GitLab Dedicated customers using the specified patched internal releases do not need to take additional action for this vulnerability. Self-managed customers, however, should verify their installed versions and apply the relevant security updates.
The company has also published two detection rules to help administrators identify potential exploitation attempts in application logs. The rules, named “Onigmo native worker crash” and “Org mode render error burst,” can help security teams investigate suspicious activity.
As of the available reporting, there was no confirmed evidence that the vulnerability had been exploited in attacks. However, its maximum severity rating and potential for unauthenticated code execution make it a serious risk for affected installations.
The October 21 security release addresses 11 security issues in total, including additional vulnerabilities involving authentication and cache poisoning. Administrators should review the official GitLab security advisory, check their installed versions, and prioritize patching vulnerable systems.
Official advisory: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
