# Critical GitLab RCE Vulnerability Affects All Versions Since 2014, Patch Immediately  **GitLab** has released urgent fixes for a severe remote code execution (RCE) vulnerability, **CVE-2026-110264**, impacting all self-managed instances of its software since version 7.0, released in 2014. This flaw, rated a maximum 10.0 on the CVSS scale, could allow an unauthenticated attacker to execute arbitrary code on the server. ## Unauthenticated RCE and Widespread Impact The vulnerability stems from an integer overflow during the compilation of a specially crafted regular expression within **GitLab**'s internal **Onigmo** regular expression engine. While **GitLab** has not disclosed the specific conditions required for exploitation, the severity rating underscores the critical risk. Crucially, this fix supersedes a previous update on October 12, which only addressed versions 19.2 and later. Administrators who applied that earlier patch must update again to secure their systems. ## Patching Guidance and Affected Versions Only self-managed **GitLab** installations are affected. **GitLab.com** and **GitLab Dedicated** tenants on specific internal releases (19.3.5-internal0, 19.4.2-internal0, or later) are already protected. **GitLab** has backported the fix to an unprecedented seven versions simultaneously, extending beyond its usual policy of patching only the current and two previous monthly releases. This exceptional measure highlights the gravity of **CVE-2026-110264**. Here's a breakdown of the required upgrades: | If you run | Upgrade to | | :----------------- | :----------- | | 19.5 before 19.5.1 | 19.5.1 | | 19.4 before 19.4.3 | 19.4.3 | | 19.3 before 19.3.6 | 19.3.6 | | 19.2 before 19.2.9 | 19.2.9 | | 19.1 before 19.1.9 | 19.1.9 | | 19.0 before 19.0.10| 19.0.10 | | 7.0 through 18.11, before 18.11.13 | 18.11.13 | ## Detecting Exploitation Attempts To aid administrators, **GitLab** has released two detection rules: "Onigmo native worker crash" and "Org mode render error burst." These rules, part of the company's open-source **TLDR framework**, are written in **Sigma** format and target **GitLab**'s application logs. As **GitLab** has not specified preconditions for attacker access to the compiler, a definitive workaround is not available. Applying the patch remains the only certain protection. ## A Pattern of Regex Engine Flaws This is the fourth code execution flaw in **GitLab**'s regular expression engine reported by researcher **joaxcar** within a month, and the first to impact versions prior to 19.2. Previous vulnerabilities include: * **CVE-2026-97229**: An unauthenticated 10.0 CVSS overflow in the regex compiler, fixed on October 12 in versions 19.2.8, 19.3.5, and 19.4.2. * **CVE-2026-93577** and **CVE-2026-89078**: Two flaws rated 9.9 CVSS, requiring a logged-in account, fixed on September 23. These earlier issues were limited to versions 19.2 and newer. ## Other Security Fixes and Upgrade Considerations The October 21 release addresses a total of 11 security issues, including one critical, several high, and other medium/low severity flaws. Notable among these are two authentication-related vulnerabilities: * **CVE-2026-15723**: A high-severity (8.2 CVSS) flaw allowing a logged-in user to take over another account under specific **SAML** and **LDAP** auto-linking configurations. * **CVE-2026-112212**: A high-severity (7.5 CVSS) cache-poisoning flaw in **GitLab**'s **OAuth** and **OpenID Connect** endpoints, which could redirect sign-in flows to an attacker-controlled server in setups utilizing a shared cache. Administrators should be aware that **GitLab** versions 19.4.3 and 19.3.6 include database changes that will run during the upgrade process. This may result in downtime for single-node servers. Multi-node setups, however, can leverage **GitLab**'s zero-downtime procedure to apply the patch without interruption. As of October 22, there is no evidence of **CVE-2026-110264** being actively exploited, and it is not yet listed in the **U.S. CISA** catalog of known exploited vulnerabilities. Nevertheless, the critical nature and wide-ranging impact demand immediate attention.