GitLab Fixes Critical CVE-2026-110264 Flaw with Maximum CVSS Score

CVE-2026-110264 in GitLab is a vulnerability that, according to the vendor, has the maximum CVSS 3.1 score of 10.0. The flaw affects self-managed GitLab CE/EE installations from version 7.0 and, under certain conditions, could allow an unauthenticated attacker to execute arbitrary code on a GitLab server.

Security updates were released on October 21, 2026, in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab recommends that all operators of affected self-managed installations immediately upgrade to the fixed version in the branch they use.

CVE-2026-110264 Occurs in the Regular Expression Compiler

According to GitLab, the issue is an integer overflow in the regular expression compiler. The vendor states that, if certain unspecified conditions are met, the flaw could lead to arbitrary code execution on the server without authentication.

GitLab has not yet disclosed the complete technical attack prerequisites or a public exploit detail. Therefore, the official advisory does not make it possible to determine the exact exploitation procedure or the specific inputs that would trigger the flaw.

The scope of the problem is broad: both GitLab Community Edition and Enterprise Edition are affected from version 7.0 through the releases replaced by the fix. Organizations should verify the branch they use and deploy the corresponding fixed version: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 or 19.5.1.

GitLab CVE-2026-110264 Requires Self-Managed Server Updates

According to the company, GitLab.com is already running a fixed version. Selected current GitLab Dedicated deployments also include the fix. Self-managed environments remain the priority, as their operators are responsible for updating them.

For single-node installations, planned maintenance should account for possible downtime because the upgrade may perform database migrations. For multi-node installations, GitLab states that a zero-downtime procedure is possible.

The official advisory does not list an alternative mitigation. Updating to one of the released fixed versions is therefore the confirmed solution.

Two Detections for Exploitation Attempts

For customers with self-managed GitLab, the vendor published two detections for exploitation attempts: “Onigmo native worker crash” and “Org mode render error burst.” Administrators can assess these detections together with a review of relevant logs in their environment.

However, the existence of detection rules alone does not confirm that attackers are already actively exploiting CVE-2026-110264. GitLab did not confirm such activity in its advisory.

For publicly accessible GitLab servers, the severity of the flaw is primarily due to the combination of the maximum CVSS score and the possibility of an attack without authentication. GitLab servers often process source code, CI/CD configurations, tokens and other data related to software development.

What to Monitor After the Fix Is Released

• confirmation or denial of active exploitation by GitLab or security agencies,
• any disclosure of technical details, a PoC or more precise attack conditions,
• the deployment status of fixes across all self-managed installations,
• the results of reviewing the two published detections and operational logs.

Verified and updated: October 21, 2026 22:50