CVE-2026-110264 (CVSS 10.0): GitLab’s Second Critical RCE in 10 Days Hits Every Version Since 2014 — Patch Now

If you patched GitLab on 12 October 2026 and breathed a sigh of relief, read this now. A second, entirely separate critical flaw — CVE-2026-110264 — was disclosed and patched on 21 October, and it carries the maximum CVSS score of 10.0. Every self-managed GitLab Community Edition and Enterprise Edition instance back to version 7.0, released in 2014, is vulnerable. Twelve years of releases. No workaround. The only fix is an upgrade to one of the patched builds released on 21 October — and until that happens, an unauthenticated attacker on the public internet can run arbitrary code on your GitLab server.

GitLab’s October Déjà Vu: Two CVSS 10 Flaws in Ten Days

Ten days ago, Sanjay Seth’s team covered CVE-2026-97229 — a CVSS 10.0 integer overflow in GitLab’s CI/CD Regular Expression Compiler that carried a public exploit and was actively targeted in the wild. Patched versions at the time were 19.2.8, 19.3.5 and 19.4.2. Organizations scrambled to update, and most did.

Now comes CVE-2026-110264, and its scope dwarfs the first. Where CVE-2026-97229 was discovered in the CI/CD pipeline component and affected recent releases, CVE-2026-110264 lives in the Onigmo regex library that GitLab’s own bundled Ruby has shipped with since version 7.0 — more than a decade of packaged builds. GitLab discovered the flaw while investigating the October 12 patches, found a deeper root in the Ruby runtime, and pushed fixes for every maintained branch plus the legacy 18.x series on 21 October.

The researcher who found and responsibly disclosed it through HackerOne is credited only by the handle joaxcar. GitLab has not published a detailed root-cause write-up yet, but the advisory confirms: no authentication is required, no privileges are needed, and no user interaction takes place on the victim’s side. That maps to a CVSS 10.0 with all base metrics at maximum severity.

Technical Breakdown: How a Regex Integer Overflow Becomes Unauthenticated RCE

GitLab’s Omnibus packages and Container-Native GitLab (CNG) images ship with their own bundled Ruby runtime, distinct from any Ruby installed on the underlying operating system. That bundled Ruby includes Onigmo, a high-performance regular expression engine forked from Oniguruma and embedded since GitLab 7.0.

The vulnerability is an integer overflow in Onigmo’s regex compiler. When a regex pattern causes the compiler’s internal length counter to overflow, it writes beyond its allocated buffer. On an affected version, an attacker can submit a crafted pattern through any endpoint that triggers regex compilation — and because regex evaluation happens before authentication in several code paths, the attacker needs no account, no session token, and no privileged access.

Detail	Value
CVE ID	CVE-2026-110264
CVSS Score	10.0 (Critical)
Vulnerability Type	Integer overflow → heap corruption → unauthenticated RCE
Component	Onigmo regex library in GitLab’s bundled Ruby
Authentication Required	None
Affected Versions	GitLab CE/EE 7.0 (2014) through 19.4.2
Patch Date	21 October 2026
Reporter	joaxcar via HackerOne
Workaround	None — upgrade is the only fix
Exploitation in Wild	Not confirmed as of 22 October 2026

The exploit primitive — a heap corruption from an integer overflow — is the same class of memory corruption that underlies some of the most powerful offensive tooling seen in enterprise environments. While GitLab has not published a proof-of-concept timeline, independent researchers have noted that this attack surface is public-facing, parser-based, and requires no user interaction, a combination historically associated with rapid weaponisation once details circulate in underground forums.

Why the October 12 Patch Leaves You Exposed

This is the most dangerous misunderstanding right now. Organizations that read the original CVE-2026-97229 advisory and applied the October 12 builds — 19.2.8, 19.3.5 or 19.4.2 — addressed only the CI/CD pipeline overflow. They did not receive the Onigmo fix, because that fix was not ready until October 21.

The October 21 builds sit one version increment above the October 12 builds in every branch:

• Branch 19.2: 19.2.8 (Oct 12) → 19.2.9 (Oct 21) ← upgrade to this
• Branch 19.3: 19.3.5 (Oct 12) → 19.3.6 (Oct 21) ← upgrade to this
• Branch 19.4: 19.4.2 (Oct 12) → 19.4.3 (Oct 21) ← upgrade to this
• Branch 19.5: 19.5.1 (Oct 21)
• Branch 19.1: 19.1.9 (Oct 21)
• Branch 19.0: 19.0.10 (Oct 21)
• Branch 18.11: 18.11.13 (Oct 21)

If your self-managed instance is running anything not on that list, it is vulnerable. If it is internet-facing — as many corporate GitLab deployments are, for remote developer access — you should treat this as a priority-zero patch.

India Context: Why Self-Managed GitLab Is Everywhere — and at Risk

GitLab is particularly prevalent in India’s technology landscape. Large IT service providers, product engineering teams, public-sector defence contractors, and fintech organisations routinely operate self-managed GitLab because it keeps their source code on-premise, behind the corporate perimeter. That deployment choice was sound from a data-residency and compliance standpoint. However, it also means that every one of those instances is now carrying a CVSS 10.0 RCE until upgraded.

Worse, many Indian organisations with multi-site deployments run GitLab behind an SSL-terminating reverse proxy with a WAF. A WAF rule for this flaw does not yet exist in any major product’s default ruleset, because the attack path is through legitimate GitLab functionality — regex compilation — not through a known-malicious payload pattern. WAF is not your safety net here.

For organisations regulated under India’s DPDP Act or those holding RBI mandates, an unauthenticated RCE on the source code repository is also a potential data breach event the moment it is exploited. Your DevSecOps pipeline, your signing keys, your credentials stored in CI/CD variables, your entire source code history — all reachable once an attacker has code execution on the GitLab server.

What You Should Do Right Now

As a zero-trust practitioner and long-time GitLab deployment consultant across Delhi NCR and multi-branch Indian enterprises, here is the prioritised action list:

1. Check your running version immediately. Log in to the Admin Area → Help. If you see any build older than the patched versions listed above, stop reading and open a change request now.
2. Plan for downtime on branches 19.3 and 19.4. Those branches introduce database migrations in 19.3.6 and 19.4.3. GitLab will be unavailable during the migration. Block developer access before starting the upgrade to prevent failed operations from corrupting data mid-migration.
3. Restrict network access immediately if you cannot patch tonight. If internet-facing, restrict the GitLab web port (443) to known IP ranges using your firewall or security group until the patch can be applied. This is a compensating control, not a fix.
4. Rotate all CI/CD secret variables. Even if you have no evidence of exploitation, treat your GitLab CI/CD variables as potentially compromised if your instance was internet-exposed and unpatched after 21 October. Rotate tokens, API keys, and deployment credentials stored there.
5. Review Gitaly and GitLab Runner service accounts. A successful exploit gives the attacker the privilege level of the GitLab application process. Map what that account can reach — internal APIs, database credentials, Gitaly storage — and limit those paths.
6. Check your GitLab production.log and gitlab-rails/api_json.log for unusual patterns: very long search, filter, or query parameters containing regex metacharacters, HTTP 500 responses accompanied by crashes in sidekiq.log, or unexpected high CPU on the Puma workers. These are early indicators of exploit attempts.
7. Implement zero-trust network access (ZTNA) for your GitLab instance. Putting self-managed GitLab behind a device-identity and user-identity aware zero-trust gateway means that even a CVSS 10.0 public-facing flaw is only reachable to authenticated, posture-checked sessions — dramatically reducing the exploitable attack surface before a patch is even available.

The Bigger Picture: GitLab as Critical Supply-Chain Infrastructure

Two CVSS 10.0 vulnerabilities in GitLab within a ten-day window signals something important: the platform is under intensive security scrutiny, and the Onigmo library — shared across many open-source projects that bundle Ruby — is an attractive research target. The same Onigmo engine is used in other Ruby-based products; expect related advisories to follow.

More broadly, source code repositories have become Tier-1 targets for state-linked actors and financially motivated ransomware groups. The China-linked ARMORY CASTLE group’s exploitation of BeyondTrust Remote Support earlier this month shows how attackers chain perimeter vulnerabilities to reach deep into enterprise infrastructure. A GitLab compromise, by contrast, gives an adversary the keys to the codebase itself — a supply-chain foothold that can persist for months before discovery.

The good news: as of 22 October, there is no confirmed exploitation and no public proof-of-concept. You still have a head start. Use it.

Frequently Asked Questions

Does this affect GitLab.com or GitLab Dedicated cloud instances?

No. GitLab patched its own SaaS environment proactively before publishing the advisory. If you use GitLab Dedicated, instances running the internal builds 19.3.5-internal0 or 19.4.2-internal0 and later are also already covered. Only self-managed installations are at risk — meaning any GitLab you installed and operate yourself, on-premise or in your own cloud tenant.

I applied the October 12 patch for CVE-2026-97229. Am I safe?

No. The October 12 patches (19.2.8, 19.3.5, 19.4.2) fixed the CI/CD integer overflow (CVE-2026-97229) but did not include the Onigmo fix. CVE-2026-110264 requires a separate upgrade to the October 21 builds listed in this article. Think of it as two different mechanics under the same bonnet — fixing one does not fix the other.

Is there any WAF or IPS rule that can block exploitation until we patch?

Not reliably. The attack flows through legitimate GitLab functionality (regex compilation), and the malicious payload is a crafted regex string that differs only subtly from valid patterns. No major WAF vendor has published a signature as of 22 October. A network-level block of inbound GitLab access to known-good IPs is a reasonable compensating control, but it is not a substitute for patching. GitLab has explicitly stated: there is no workaround.

What is the risk if I’m running GitLab only on an internal LAN with no internet exposure?

Significantly lower, but not zero. An attacker who has already breached your perimeter — through phishing, a compromised laptop, or a separate vulnerability — can pivot to GitLab from inside the LAN. Given that GitLab is typically one of the most privileged internal services (it holds your source code, CI/CD secrets, and often service account credentials), it remains a high-value target even in a non-internet-facing deployment. Patch it anyway — ideally within 72 hours.

---

Get Expert Help Securing Your GitLab Deployment

Managing patch windows, rotating CI/CD credentials, and designing zero-trust access for developer tools takes practised hands. Sanjay Seth and the P J Networks team have deployed and hardened GitLab for some of India’s most demanding engineering organisations. If you need an emergency assessment of your current GitLab exposure, help designing ZTNA controls, or a full DevSecOps security review, reach out for a consultation. We respond within hours for active security incidents.

Sources: GitLab Critical Security Release Advisory · The Hacker News · GB Hackers · SOC Prime Analysis · Rescana Advisory · Safeguard.sh