GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
› GitLab CE/EE (self-managed)
- started
- Oct 21, 2026
- closed
- ongoing
- CVEs
- 1
- sources
- 5
## summary
GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.
severity: CVSS 10.0 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
## cve ids[1]
## affected
- All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1
## fixed in
- 19.5.1
- 19.4.3
- 19.3.6
- 19.2.9
- 19.1.9
- 19.0.10
- 18.11.13
## timeline[2]
GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.
Prior critical regex patch released (separate CVE); some operators stopped there.
## advisories[2]
## posts[3]
patched self-managed GitLab on 12 Oct? patch again. that release fixed a CVSS 10 regex RCE at 19.4.2. yesterday's CVE-2026-110264 is another CVSS 10 in the regex compiler, and 19.4.2 is still in range. fixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
Si parcheaste tu GitLab hace 9 días y te quedaste tranquilo, tengo malas noticias: vuelves a estar expuesto. GitLab ha corregido hoy el CVE-2026-110264, puntuado con un 10 sobre 10 en CVSS. Permite ejecutar código en el servidor sin iniciar sesión. Afecta a todas las versiones
米GitLabは10月21日（現地時間）、開発プラットフォーム「GitLab」に深刻（Critical）な脆弱性（CVE-2026-110264）が見つかったと発表し、修正版を公開した。CVSSスコアは最大の「10.0」。特定の条件下で、認証されていないユーザーがGitLabサーバ上で任意のコードを実行できる可能性がある… t.co/9RBiQlMg8N
## notes & caveats
No confirmed in-the-wild exploitation stated by GitLab as of Oct 22; keep live because of CVSS 10, broad self-managed exposure (~60k Shodan mentions in secondary reporting), and the “patch again” confusion after Oct 12.
