GitLab CVE-2026-110264: ten out of ten on the source code

CVE-2026-110264, an integer overflow in Onigmo, the regular expression engine bundled with GitLab's Ruby runtime, scored 10.0. It affects self-managed GitLab Community and Enterprise up to 19.5.0.

The fixed releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. It was reported through GitLab's HackerOne programme.

GitLab rates it exploitable over the network with no account. It has not published the exact conditions, and it lists no workaround.

As of 22 October, no exploitation had been reported, and the flaw was not in CISA's catalog of exploited vulnerabilities.

When a regular expression is compiled, a size calculation overflows and the engine writes past the memory it set aside.

Under the right conditions, that memory corruption becomes code execution on the server, with the rights of the GitLab process.

Code execution on the server that holds the source code, the CI/CD variables and the runner tokens. That opens the repositories, the pipeline secrets and the cloud credentials, and every release built there.

Upgrade to the fixed release for your branch. If you cannot upgrade at once, take the instance off the Internet, behind a VPN.

If the instance was exposed, rotate the runner tokens and the CI/CD secrets after the upgrade, and review recent commits and pipeline changes.

Sources: GitLab critical patch release 19.5.1 (21 October 2026), CVE-2026-110264 record.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.