GitLab released fixes on October 21 for CVE-2026-110264, a vulnerability rated 10.0 on the CVSS scale. The flaw is an integer overflow in the Onigmo regular-expression compiler bundled with GitLab packages. Under certain conditions, an unauthenticated user can exploit it to execute arbitrary code on a self-managed server. The vulnerable engine has been shipped in every release since GitLab 7.0, which was released in 2014.
GitLab says only self-managed installations are exposed. GitLab.com already runs a fixed version, and GitLab Dedicated tenants on internal releases 19.3.5-internal0 or 19.4.2-internal0 and later are also patched. The company released fixed versions across seven branches: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Four of those branches are backports beyond its usual three-release policy, a step GitLab says it reserves for severe issues. Administrators who upgraded on October 12 should note that that patch only covered 19.2 and later, and the new fixed versions sit one patch above those, so they are in range again.
GitLab has not disclosed what preconditions an attacker needs to reach the compiler, and the advisory includes no interim workaround, making the upgrade the only certain protection. The company says it has no evidence the flaw has been exploited in the wild, and as of October 22 it is not listed in CISA's Known Exploited Vulnerabilities catalog. This is the fourth code-execution bug in the regex engine reported by researcher joaxcar in a month, and the first to affect versions older than 19.2. The same release also fixes 10 other security issues, including an 8.2-rated account-takeover issue and a 7.5-rated OAuth/OpenID Connect cache-poisoning flaw.