The most urgent story in cybersecurity news today is a maximum-severity flaw in the tool that hosts the code. CVE-2026-110264, rated CVSS 10.0, is an integer overflow in the Onigmo regular-expression compiler that GitLab bundles inside its own packages — and it could let an unauthenticated attacker run arbitrary code on a self-managed GitLab server. It affects every self-managed release since GitLab 7.0, shipped in 2014. GitLab released fixes on October 21, 2026 in seven versions at once. And there is a trap: the emergency patch many administrators installed nine days ago, on October 12, does not cover this flaw. If you run your own GitLab, the version checker below gives you a verdict and your exact upgrade target in under a minute.
Put the scope in one sentence: GitLab's advisory puts this flaw in 100 percent of self-managed releases shipped since 7.0 — there is no old-but-safe branch to hide on, and the long tail of rarely updated self-hosted instances is exactly the exposed population.
The detail that turns a bad flaw into an operational trap is the calendar. On October 12, 2026, GitLab fixed CVE-2026-97229 — also an unauthenticated CVSS 10.0 integer overflow in the same regex compiler, also reported by joaxcar — in versions 19.2.8, 19.3.5, and 19.4.2. Administrators who dropped everything and patched that day did everything right. They are vulnerable again: the October 12 fix only covered versions 19.2 and later, while CVE-2026-110264 reaches back to 7.0, and each new fixed version sits exactly one patch release above the October 12 build for its branch. Run 19.4.2 today and your branch's fix is 19.4.3. Before that, on September 23, GitLab fixed two more joaxcar regex flaws, CVE-2026-93577 and CVE-2026-89078, both rated 9.9 but requiring a logged-in account — and all three earlier flaws stopped at version 19.2. This one does not.
The October 21 release fixes 11 security issues in all. Two of the others deserve a look while you plan the upgrade: CVE-2026-15723, rated high at 8.2, could let a logged-in user take over another account when an administrator has enabled both SAML and LDAP auto-linking; and CVE-2026-112212, rated high at 7.5, is a cache-poisoning flaw in GitLab's OAuth and OpenID Connect endpoints that could redirect certain sign-in flows to an attacker-controlled server in setups that use a shared cache. GitLab also published two detection rules for self-managed administrators, written in Sigma format against GitLab's own application logs under its open-source TLDR framework: "Onigmo native worker crash" and "Org mode render error burst". Run them — but treat detection as a hunt for attempts, not as a substitute for the upgrade.
| If you run | Upgrade to | Status |
|---|---|---|
| 19.5 before 19.5.1 | 19.5.1 | Fixed release for the 19.5 branch |
| 19.4 before 19.4.3 | 19.4.3 | Includes database changes — single-node upgrades mean downtime |
| 19.3 before 19.3.6 | 19.3.6 | Includes database changes — single-node upgrades mean downtime |
| 19.2 before 19.2.9 | 19.2.9 | One patch above the October 12 build (19.2.8) |
| 19.1 before 19.1.9 | 19.1.9 | Backported beyond GitLab's normal patch policy |
| 19.0 before 19.0.10 | 19.0.10 | Backported beyond GitLab's normal patch policy |
| 7.0 through 18.11, before 18.11.13 | 18.11.13 | One fixed release covers twelve years of branches |
| GitLab.com / GitLab Dedicated (19.3.5-internal0, 19.4.2-internal0 or later) | — | Already fixed — no action needed |
Plan for the upgrade cost before you start: the 19.4.3 and 19.3.6 releases include database changes that run during the upgrade, so a single-node server will be down while they finish. Multi-node setups can apply the patch without downtime using GitLab's zero-downtime upgrade procedure.
Type your self-managed GitLab version exactly as reported (from sudo gitlab-rake gitlab:env:info or your instance's help page). Everything runs in your browser; nothing is sent anywhere.
GitLab Dedicated: tenants on 19.3.5-internal0 or 19.4.2-internal0 or later already include this fix — the table and verdicts below are for self-managed releases.
BreachHunter — Ingenious AI's intrusion and breach-signal hunter — exists for exactly the window CVE-2026-110264 opens: the days between "a CVSS 10.0 flaw reaches every release since 2014" and "your upgrade is verified live," when the question stops being are we exposed and becomes did anyone reach the compiler first. Get early access on WhatsApp.
1. What does CVE-2026-110264 let an attacker do?
2. Your server runs GitLab 19.4.2 — the build you installed in the October 12 emergency patch. What is your status?
3. Which GitLab installations must act on this flaw?
4. Is there a configuration workaround if you cannot upgrade today?
5. The flaw sits in which component?
CVE-2026-110264 is a critical vulnerability in self-managed GitLab, rated CVSS 10.0, the maximum score. An integer overflow in the Onigmo regular-expression compiler that GitLab bundles in its own packages could let an unauthenticated attacker run arbitrary code on the server, under certain conditions GitLab has not disclosed. It affects every self-managed release since GitLab 7.0 in 2014, and the only fix is upgrading to a patched release.
Every self-managed GitLab release since 7.0 is affected — there is no unaffected older branch. GitLab fixed the flaw on October 21, 2026 in seven releases: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, and 19.0.10, plus 18.11.13, which covers every branch from 7.0 through 18.11. GitLab.com already runs a fixed version, and GitLab Dedicated tenants on the named internal releases or later already have the fix.
No. The October 12 release fixed CVE-2026-97229, a different flaw in the same Onigmo regex compiler, and it only covered versions 19.2 and later. CVE-2026-110264 reaches back to 7.0, and each of its fixed versions sits one patch release above the October 12 builds — so if you run 19.2.8, 19.3.5, or 19.4.2, you patched nine days ago and are in range again. Upgrade once more to the October 21 fixed release for your branch.
On the server, run sudo gitlab-rake gitlab:env:info and read the GitLab version line, or open your instance's help page. Compare the version with the fixed list: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for anything from 7.0 through 18.11. Below your branch's fixed release means vulnerable. The checker on this page does the comparison for you — type the version and get the verdict plus your exact upgrade target.
GitLab reports no sign of exploitation so far, and as of October 22, 2026 the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog. There is no configuration workaround: GitLab has not disclosed the preconditions an attacker needs, so administrators cannot rule themselves out by settings. GitLab published two detection rules for its own logs — 'Onigmo native worker crash' and 'Org mode render error burst' — but detection is not protection. Upgrading is the only certain fix.
Sources: The Hacker News, October 2026 (the CVE-2026-110264 disclosure, the seven fixed versions, the Onigmo root cause, the October 12 overlap, the detection rules, and the upgrade downtime notes) · GitLab's October 21, 2026 patch release and CVE-2026-110264 advisory, as reported in the coverage above · Rescana's CVE-2026-110264 write-up, October 2026 (independent cross-check of the fixed-version table and the KEV status).