Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

Key Points:

• GitLab released critical security fixes on October 21 for a severe code-execution vulnerability (CVE-2026-110264) affecting all self-managed versions since 7.0 (2014), allowing unauthenticated attackers to run arbitrary code via an integer overflow in its regex compiler.
• The flaw is rated 10.0 (maximum severity) on the CVSS scale, and GitLab has not observed exploitation attempts or listed it in known exploited vulnerabilities; only self-managed instances need to patch, as GitLab.com and certain Dedicated tenants are already protected.
• The update supersedes the October 12 patch that covered only versions 19.2 and later, requiring administrators who updated then to apply the new fixes, which cover seven release branches including older versions beyond GitLab's usual support window.
• GitLab backported the fix to older releases due to the vulnerability residing in the Onigmo regex engine embedded in all versions since 7.0, and published detection rules to help admins monitor for exploitation attempts, though no interim workaround exists.
• The October 21 release also addresses 10 other security issues, including high-severity authentication flaws, and some patches require database migrations that may cause downtime on single-node servers, with zero-downtime upgrade options available for multi-node setups.