An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Fix
Microsoft's update · Critical
- Release Notes — azl3 ruby 3.3.5-10 on Azure Linux 3.0 · build 3.3.13-0
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-29.
Public exploits 12
- FranklinF25/regex2shell PoC on GitHub
- Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE PoC on GitHub
- TahuCryptsi/gitlab-onigmo-check PoC on GitHub
- TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264 PoC on GitHub
- TheGlitchFixer/gitlab-patch-check PoC on GitHub
- al4n4n/CVE-2026-110264 PoC on GitHub
- bastet-ai/gitlab-firing-range PoC on GitHub
- emirwtz/CVE-2026-110264 PoC on GitHub
- farimazhar/GitLab2Safe-Defensive-Checker PoC on GitHub
- googlesky/CVE-2026-110264 PoC on GitHub
- lesterlam/onigmo-cve-2026-110264 PoC on GitHub
- xaviware/go-gitlab-cve-2026-110264-scanner PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ Release Notes, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 4
- Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 | Ruby r/blueteamsec · 2026-10-23
- Max-severity GitLab bug allows remote code execution over 12 years of releases The Register · Security · 2026-10-22
- Update GitLab CE/EE to Fix Maximum-Severity Flaw SANS NewsBites · 2026-10-22
- CVE-2026-110264 GitLab Unauthenticated RCE (CVSS 10) r/cybersecurity · 2026-10-21
Change history 8
- Cpes+4 CPE criteria (now 4)NVD modified 2026-10-27 14:07
- StatusPublished → AnalyzedNVD modified 2026-10-27 14:07
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-22 12:50
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-22 23:18
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-22 12:50
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-22 16:18
- StatusReceived → PublishedNVD modified 2026-10-22 12:50
- First seenCVSS 10.0NVD modified 2026-10-22 01:16
Affected (CPE criteria) 4
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:community:*:*:*cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*
References 3
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/633633 Permissions Required
- https://hackerone.com/reports/4093475 Permissions Required