Critical GitLab Local Vulnerability CVE-2026-110264: Patch Immediately

October 21, 2026

GitLab has released security updates for CVE-2026-110264, a critical vulnerability rated CVSS v3.1 10.0. A specially crafted regular expression can trigger an integer overflow that, under certain conditions, allows an unauthenticated attacker to execute code on the GitLab server. GitLab recommends immediately upgrading affected self-managed installations. ¹

Organizations that installed the October 12 patches should review their versions again. Those releases addressed CVE-2026-97229, a separate vulnerability affecting the CI/CD regular-expression compiler. The earlier fixed versions—19.2.8, 19.3.5 and 19.4.2—fall within the affected ranges for CVE-2026-110264. ^2, 1

Affected versions and fixed releases

GitLab identifies the following affected versions of Community Edition and Enterprise Edition. GitLab.com is already patched. GitLab Dedicated tenants running 19.3.5-internal0, 19.4.2-internal0 or later already include the fixes. ¹

These are fixed-version boundaries, not instructions to skip intermediate upgrades. Older installations must follow GitLab’s required upgrade stops and complete background migrations before proceeding to subsequent releases. ³

Technical impact and detection

GitLab’s detection documentation associates this vulnerability with Org-mode rendering, involving .org files, the org-ruby parser and Ruby’s Onigmo regular-expression engine. It describes execution under the git service account and potential exposure of repositories, instance secrets, CI/CD variables and tokens. These are documented consequences of exploitation; they do not establish that customer systems have been compromised. ⁴

GitLab has published two detections relevant to this vulnerability:

• Onigmo native worker crash: Examines Ruby crash reports containing org-ruby or Onigmo stack frames. GitLab cautions that successful exploitation may occur without a crash, so the absence of this signal does not rule out compromise. ⁵
• Org mode render error burst: Looks for repeated timeouts while rendering .org files, including five or more matching exceptions from one client within 30 minutes. Administrators should verify that the required logs are collected before relying on the detection. ⁴

Public exploitation status

At the time of review on October 21, CVE.org still marked the identifier Reserved, while GitLab had published the vulnerability details and fixes. A search of CISA’s Known Exploited Vulnerabilities catalog returned no entry for this CVE. These observations do not establish that exploitation has not occurred. ^6, 7, 1

Recommended actions

Administrators should take the following actions:

1. Prepare and apply the upgrade. Confirm the installed version and deployment method, back up the instance—including configuration and secrets—and document the rollback procedure. Follow the required upgrade path. ^8, 3
2. Account for database migrations. Releases 19.4.3 and 19.3.6 include regular migrations. GitLab warns of downtime on single-node installations; eligible multi-node deployments should follow its zero-downtime procedure. ¹
3. Review for exploitation evidence. Investigate matching render errors and native crashes alongside unexpected processes, outbound connections, and changes to the git account’s SSH keys or scheduled tasks. Preserve relevant logs and follow incident-response procedures if evidence of code execution is found. ⁵
4. Verify recovery. Confirm the fixed version is running, migrations have completed, and users can authenticate, access repositories and run CI/CD jobs. ⁸