GitLab patches critical regex flaw affecting versions since 2014

GitLab released security fixes on October 21 for a flaw allowing unauthenticated remote code execution. The vulnerability affects versions dating back to 7.0, which was released in 2014. The issue is tracked as CVE-2026-110264 and carries a CVSS score of 10.0. GitLab states the flaw allows an unauthenticated user to run arbitrary code due to an integer overflow during the compilation of a specially crafted regular expression.

The vulnerability stems from a weakness in Onigmo, Ruby's built-in regular-expression engine, which GitLab ships inside its own packages. Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo responsible for four critical GitLab RCE flaws. Ruby notes that any application building a regular expression from attacker-controlled text is affected. An earlier release, 4.0.8, does not include the fix for this specific vulnerability.

This is the fourth code-execution flaw in GitLab's regular-expression engine reported by researcher joaxcar in a month. On October 12, GitLab fixed CVE-2026-97229, another unauthenticated 10.0 overflow in the regex compiler. The October 12 update only covered versions 19.2 and later, leaving instances updated then vulnerable again after the new fixes were applied. Bug hunter Johan Carlsson reported the vulnerability through GitLab's HackerOne bug bounty program.

GitLab reports no evidence that the flaw has been used in attacks. It was not listed in the U.S. CISA catalog as of October 22. Only self-managed installations require action, while GitLab.com and specific GitLab Dedicated tenants already have the fix. GitLab published two detection rules to help administrators look for exploitation attempts. The vendor has not provided an interim workaround because the preconditions for an attacker are unknown. GitLab backported the patch to versions 19.2.9, 19.1.9, 19.0.10, and 18.11.13.