2026-10-25
GitLab CVE-2026-110264 (CVSS 10.0): how to check and update a self-managed GitLab
On October 21, 2026, GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for Community Edition (CE) and Enterprise Edition (EE). The most severe flaw, CVE-2026-110264 (CVSS 10.0), is an integer overflow when compiling a specially crafted regular expression that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server. Almost every version from 7.0 onward is affected. GitLab.com is already patched; self-managed installations need to upgrade. The same release fixes two High-severity flaws (CVSS 8.2 and 7.5) and others, but those fixes ship only in the 19.3.6, 19.4.3 and 19.5.1 lines. The root cause is in Ruby's regular expression engine (Onigmo), and Ruby released 4.0.9, 3.4.12 and 3.3.13 on October 23. Applications that compile a regexp from attacker-controlled strings are affected, and Regexp.timeout does not protect against the bugs. No exploitation has been reported, and the flaw is not in CISA's KEV catalog as of October 25. This site's conclusion: upgrade self-managed GitLab today after checking the required upgrade stops, and end up on 19.3.6 or later. Ruby applications should move to a fixed Ruby and stop building regexps from user input.