CVE-2026-110264
GitLab Org-mode regex overflow allows unauthenticated code execution
GitLab CE/EE flaw rated CVSS 3.1 10.0. An integer overflow in the regular expression compiler can, under certain conditions, let an unauthenticated user run code on a self-managed GitLab server. All versions from 7.0 are affected. Fixed on 21 October 2026 in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com and Dedicated already patched. Not in CISA KEV. No confirmed public PoC.
By ThreatWire Desk · Published 22 Oct 2026
- CVSS
- 10
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Class
- RCE
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- GitLab
- Products
- GitLab CE, GitLab EE
- Affected
- GitLab CE/EE, all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Self-managed installations only. Versions patched for CVE-2026-97229 on 12 October (19.2.8, 19.3.5, 19.4.2) are still affected.
- Fixed
- 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, released 21 October 2026. Lines older than 18.11 have no fixed release; upgrade to a supported line. GitLab.com is patched. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action.
- CWE
- CWE-190
- Published
- 22 Oct 2026
- Updated
- 22 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-110264 is a critical flaw in self-managed GitLab CE and EE. GitLab fixed it in a critical patch release dated 21 October 2026. This is not new today: the fix has been out since then.
GitLab says that, under certain conditions, an unauthenticated user could execute arbitrary code on the server. The cause is an integer overflow when a specially crafted regular expression is compiled.
GitLab scores it CVSS 3.1 10.0 (Critical). The full vector is in the CVSS field. The CVE record maps it to CWE-190. NVD lists the record as received, not yet analyzed.
Affected: every version from 7.0 before 18.11.13, plus 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. That is roughly twelve years of releases.
Fixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab backported the fix to four lines it does not normally patch. Lines older than 18.11 have no fixed release.
Servers updated on 12 October for CVE-2026-97229 are still affected. 19.4.2, 19.3.5 and 19.2.8 sit below the new fixed versions.
GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action.
Attack path. The advisory does not name it. GitLab's own detection rules do. They say the org-ruby gem builds a regex from an unescaped #+TODO: keyword in an Org-mode (.org) file. The rules say an attacker needs no login, only one public project holding a crafted .org file. They describe this path as CWE-94 and CWE-787.
Exploitation. Not in the CISA KEV catalog (catalog 2026.10.21). No attacks have been reported. GitLab's rules warn that a successful exploit can be quiet.
PoC status. No confirmed public PoC. A GitHub repository created on 22 October claims to cover this CVE. Its own README says the code targets the earlier CVE-2026-97229 bug and is unverified for this one. ThreatWire did not run it and does not link it.
Credit: joaxcar, via GitLab's HackerOne bug bounty program. GitLab makes issue details public 90 days after the fix.
Read the full news story and upgrade checklist.
Sources
- Vendor advisory
- GitLab TLDR detection, Org mode render error burst
- GitLab TLDR detection, Onigmo native worker crash
- GitLab work item 633633 (confidential until disclosure)
- HackerOne report 4093475 (not public)
- CVE.org record
- NVD entry (received, not yet analyzed)
- GitHub advisory GHSA-83vq-rvff-66gw (unreviewed)
- CISA KEV catalog
- The Hacker News, Critical GitLab flaw could allow unauthenticated RCE across 12 years of releases
- Konfirmity advisory on the 19.5.1 critical patch
- al-ice.ai analysis of the org-ruby sink