{
  "slug": "gitlab-cve-2026-110264-regex-rce",
  "category": "patch",
  "title": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
  "summary": "GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.",
  "cveIds": [
    "CVE-2026-110264"
  ],
  "product": "GitLab CE/EE (self-managed)",
  "severity": "critical",
  "severityNote": "CVSS 10.0; unauthenticated RCE in self-managed CE/EE back to 7.0 (2014); no public PoC or known exploitation as of 2026-10-22",
  "status": "live",
  "startedAt": "2026-10-21",
  "patchStatus": "patched",
  "affectedVersions": [
    "All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1"
  ],
  "fixedVersions": [
    "19.5.1",
    "19.4.3",
    "19.3.6",
    "19.2.9",
    "19.1.9",
    "19.0.10",
    "18.11.13"
  ],
  "timeline": [
    {
      "date": "2026-10-12",
      "title": "Prior critical regex patch released (separate CVE); some operators stopped there."
    },
    {
      "date": "2026-10-21",
      "title": "GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched."
    },
    {
      "date": "2026-10-22",
      "title": "Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne.",
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/"
    },
    {
      "date": "2026-10-22",
      "title": "GitLab updated its advisory with two threat detections (\"Onigmo native worker crash\" and \"Org mode render error burst\") to help self-managed customers spot exploitation attempts; GitLab.com and Dedicated remain patched.",
      "sourceUrl": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"
    }
  ],
  "sources": [
    {
      "kind": "news",
      "title": "Max-severity GitLab bug allows remote code execution over 12 years of releases",
      "url": "https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854",
      "publisher": "The Register",
      "date": "2026-10-22"
    },
    {
      "kind": "advisory",
      "title": "GitLab Critical Patch Release 19.5.1…",
      "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/",
      "publisher": "GitLab",
      "date": "2026-10-21"
    },
    {
      "kind": "advisory",
      "title": "CVE-2026-110264 (Tenable)",
      "url": "https://www.tenable.com/cve/CVE-2026-110264",
      "publisher": "Tenable/NVD",
      "date": "2026-10-22"
    },
    {
      "kind": "news",
      "title": "GitLab warns of new max severity code execution vulnerability",
      "url": "https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/",
      "publisher": "BleepingComputer",
      "date": "2026-10-22"
    }
  ],
  "tweets": [
    {
      "authorName": "flowers.engg",
      "handle": "flowersengg",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067629049481195520/xxkejAlq_bigger.jpg",
      "text": "patched self-managed GitLab on 12 Oct? patch again.\n\nthat release fixed a CVSS 10 regex RCE at 19.4.2. yesterday's CVE-2026-110264 is another CVSS 10 in the regex compiler, and 19.4.2 is still in range.\n\nfixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13",
      "date": "2026-10-21T23:57:03.000Z",
      "url": "https://x.com/flowersengg/status/2113057007309885672",
      "media": []
    },
    {
      "authorName": "Iván Pérez",
      "handle": "IvanPerezF_",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2100615087392215040/4ad0g2S8_bigger.jpg",
      "text": "Si parcheaste tu GitLab hace 9 días y te quedaste tranquilo, tengo malas noticias: vuelves a estar expuesto.\n\nGitLab ha corregido hoy el CVE-2026-110264, puntuado con un 10 sobre 10 en CVSS. Permite ejecutar código en el servidor sin iniciar sesión.\n\nAfecta a todas las versiones",
      "date": "2026-10-21T20:26:51.000Z",
      "url": "https://x.com/IvanPerezF_/status/2113004107149512943",
      "media": []
    },
    {
      "authorName": "Kenji",
      "handle": "inagakikenji",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1055736419061100545/e1Tz89g__bigger.jpg",
      "text": "米GitLabは10月21日（現地時間）、開発プラットフォーム「GitLab」に深刻（Critical）な脆弱性（CVE-2026-110264）が見つかったと発表し、修正版を公開した。CVSSスコアは最大の「10.0」。特定の条件下で、認証されていないユーザーがGitLabサーバ上で任意のコードを実行できる可能性がある… https://t.co/9RBiQlMg8N",
      "date": "2026-10-22T03:44:09.000Z",
      "url": "https://x.com/inagakikenji/status/2113114155519758377",
      "media": []
    }
  ],
  "notes": "No confirmed in-the-wild exploitation stated by GitLab as of Oct 22; keep live because of CVSS 10, broad self-managed exposure (~60k Shodan mentions in secondary reporting), and the “patch again” confusion after Oct 12.",
  "grouping": "none",
  "updatedAt": "2026-10-23T21:26:09Z",
  "stacks": [
    "devtools"
  ],
  "tags": [
    "devtools",
    "gitlab",
    "rce"
  ],
  "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce",
  "json": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json",
  "sections": [],
  "agentBrief": "# Security brief: GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)\n\nSource: https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce · status: live · severity: critical · updated Oct 23, 2026, 21:26 UTC\n\n## Patch status\n**PATCHED: fixed releases exist. Upgrade to a fixed version.**\n\n## What it is\nGitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.\n\nSeverity detail: CVSS 10.0; unauthenticated RCE in self-managed CE/EE back to 7.0 (2014); no public PoC or known exploitation as of 2026-10-22\n\n- Product: GitLab CE/EE (self-managed)\n- CVE / advisory ids: CVE-2026-110264\n\n## Affected versions\n- All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1\n\n## Check whether you're affected\nRun these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions:\n\n```sh\nsudo gitlab-rake gitlab:env:info\n```\n\n## Fix\nUpgrade to one of these fixed versions (or later on the same branch):\n- 19.5.1\n- 19.4.3\n- 19.3.6\n- 19.2.9\n- 19.1.9\n- 19.0.10\n- 18.11.13\n\nAfter upgrading, re-run the checks above and redeploy/restart the affected services.\n\n## Latest updates\n- Oct 22, 2026: Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne.\n- Oct 22, 2026: GitLab updated its advisory with two threat detections (\"Onigmo native worker crash\" and \"Org mode render error burst\") to help self-managed customers spot exploitation attempts; GitLab.com and Dedicated remain patched.\n- Oct 21, 2026: GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.\n- Oct 12, 2026: Prior critical regex patch released (separate CVE); some operators stopped there.\n\n## Advisories\n- [GitLab Critical Patch Release 19.5.1…](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) (GitLab)\n- [CVE-2026-110264 (Tenable)](https://www.tenable.com/cve/CVE-2026-110264) (Tenable/NVD)\n\n## Write-ups & news\n- [Max-severity GitLab bug allows remote code execution over 12 years of releases](https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854)\n- [GitLab warns of new max severity code execution vulnerability](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/)\n\n## Caveats\nNo confirmed in-the-wild exploitation stated by GitLab as of Oct 22; keep live because of CVSS 10, broad self-managed exposure (~60k Shodan mentions in secondary reporting), and the “patch again” confusion after Oct 12.\n\n---\nMachine-readable: https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems."
}