GitLab: Integer overflow in regex compiler enables remote code execution

Summary

GitLab Community Edition and Enterprise Edition are affected in all versions from 7.0 up to the fixed releases listed below. Under certain conditions, an unauthenticated remote attacker could execute arbitrary code on the GitLab server by sending a specially crafted regular expression that triggers an integer overflow. The vendor rates the flaw CVSS 10.0 (critical), and GitLab.com and GitLab Dedicated are already patched.

Affected

• GitLab CE/EE 7.0 before 18.11.13
• GitLab CE/EE 19.0 before 19.0.10
• GitLab CE/EE 19.1 before 19.1.9
• GitLab CE/EE 19.2 before 19.2.9
• GitLab CE/EE 19.3 before 19.3.6
• GitLab CE/EE 19.4 before 19.4.3
• GitLab CE/EE 19.5 before 19.5.1
• Self-managed installations only; GitLab.com is already patched.

Fixed in

• 18.11.13
• 19.0.10
• 19.1.9
• 19.2.9
• 19.3.6
• 19.4.3
• 19.5.1
• Fix backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9; other branches received it in standard patch releases.

Workaround

• No vendor workaround is known. GitLab's advisory names only patching.
• Interim measure (not vendor guidance): restrict network access to the GitLab instance until it is patched.

Exploitation

• As of 22 October 2026, GitLab and CISA reported no signs of exploitation of this CVE.
• I could not verify the current CISA KEV status of this CVE; recheck the KEV catalog.
• CVE-2026-97229, a different GitLab regex flaw, is listed in CISA KEV. It is not this CVE and has different affected versions.
• No verified public proof of concept for this CVE was found.
• Attack conditions beyond the unauthenticated network path are not publicly disclosed.

Our recommendation

• Upgrade self-managed GitLab to the fixed release for your branch as soon as possible.
• If you run a version older than 18.11, follow GitLab's upgrade path to 18.11.13 or later.
• Do not rely on older patch dates; verify the installed version against the list above.
• Restrict internet and partner access to the GitLab instance where possible.
• Review logs for the detection patterns GitLab published (Onigmo native worker crash, Org mode render error burst).
• If the instance was exposed while unpatched, check for compromise and rotate CI/CD and deployment secrets stored on the server.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (11 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  TahuCryptsi/gitlab-onigmo-check · TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264 · al4n4n/CVE-2026-110264 · xaviware/go-gitlab-cve-2026-110264-scanner · bastet-ai/gitlab-firing-range

Research sources

• GitLab Critical Patch Release 19.5.1 (vendor advisory) docs.gitlab.com
• GitLab issue 633633 gitlab.com
• HackerOne report 4093475 hackerone.com
• Beazley Security advisory BSL-A1235 labs.beazley.security
• Brandefense: CVE-2026-110264 what to do brandefense.io
• Astra: CVE-2026-110264 security advisory www.getastra.com
• Ruby regexp fixes for GitLab CVEs www.ruby-lang.org
• InfoWorld: GitLab critical patches www.infoworld.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:03.