GitLab Patches CVSS 10.0 Unauthenticated RCE Affecting Releases Back to Version 7.0

GitLab released emergency security updates for CVE-2026-110264, a CVSS 10.0 vulnerability that could allow unauthenticated remote code execution on self-managed Community Edition and Enterprise Edition installations under undisclosed conditions. The flaw involves an integer overflow when compiling a specially crafted regular expression in Ruby’s Onigmo engine and affects releases dating back to version 7.0. Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, extending patches to four branches outside normal maintenance. The release addresses 12 vulnerabilities, including high-severity issues involving LDAP-backed account takeover and OAuth/OIDC discovery cache poisoning.

Self-managed administrators should upgrade immediately, including those who installed the October 12 security updates; GitLab offers no interim workaround. GitLab.com and qualifying GitLab Dedicated deployments are already patched. GitLab reports no observed exploitation and has published two detection rules for potential exploitation attempts; single-node operators should plan for possible upgrade downtime. An earlier third-party report described a similar regex-related RCE under a different identifier, CVE-2026-97229, and cited fixes in versions 19.2.8, 19.3.4, and 19.4.2. Those technical claims remain unverified and should not be conflated with the current advisory or treated as evidence that those earlier versions remediate CVE-2026-110264.