On October 21 GitLab pushed out emergency updates for Community and Enterprise Edition. They fix CVE-2026-110264, rated the maximum 10.0 on CVSS 3.1: under certain conditions an outsider could run their own code on the server with no account and no user interaction.

The worst part is how old the bug is. Every release from GitLab 7.0 onward is affected, and that version shipped back in 2014. In practice almost any self-hosted instance is at risk unless it was updated this week.

Where the bug lives

The flaw is not in GitLab's own code but in Onigmo, the regular expression engine Ruby uses to search and parse text. Feed it a pattern with a huge repetition count and an internal counter overflows, corrupting memory handling. The fix simply makes the compiler reject such patterns.

Detection rules published by GitLab suggest that one attack path goes through rendering files in the .org format.

Which versions to update

All builds before 18.11.13 are affected, plus the 19.0–19.5 branches before the October patches. Fixed releases are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. Very old installs get no separate patch and have to move to a supported branch.

GitLab.com is already patched. One catch: nine days earlier GitLab fixed a different 10.0 RCE, CVE-2026-97229, also regex-related but in CI/CD. The October 12 patches do not protect against the new hole.

Is it being exploited

As of October 22 there is no public working exploit and no confirmed attacks, although the CyberOK team says it verified the bug can be exploited. If you cannot update right away, the advice is to cut the server off from outside networks for now and watch logs for unusual Ruby crashes and errors when rendering .org files.

Our take

If you or a client run your own GitLab, update today, not next sprint. Self-hosted instances often sit untouched for years, and those are exactly the servers that get hit first. It is also a good moment to check whether it really needs to be reachable from the internet. Source: SecurityLab.