Overview
- GitLab released fixes on October 21 for CVE-2026-110264, a CVSS 10.0 integer‑overflow in the bundled Onigmo regex compiler that could let an unauthenticated attacker run arbitrary code on self‑managed servers.
- The company backported patches across seven release branches so the fix covers versions stretching back to GitLab 7.0 (2014), and GitLab.com plus some Dedicated tenants are already running the patched builds.
- Administrators of self‑managed instances must upgrade immediately because the advisory gives no interim workaround and some patched releases include database migrations that can cause downtime on single‑node servers.
- GitLab published Sigma‑format detection rules for its TLDR framework and urged log and telemetry reviews; the firm reports no evidence of in‑the‑wild exploitation and CISA had not listed the CVE as exploited as of October 22.
- The flaw was reported via HackerOne by researcher 'joaxcar' and is the latest in a string of high‑severity regex‑engine bugs, which heightens risk for exposed GitLab instances and raises supply‑chain and credential‑theft concerns if servers are compromised.