GitLab Issues Emergency Security Patch for Critical CVSS 10 RCE Flaw

Developer operations platform provider GitLab issued emergency security updates on October 21 to remediate a critical unauthenticated remote code execution flaw. The security vulnerability, tracked as CVE-2026-110264, carries the maximum possible CVSS severity score of 10.0 and impacts both Community Edition and Enterprise Edition deployments. According to GitLab, under specific operating conditions, compiling specially crafted regular expressions allows unauthenticated threat actors to execute arbitrary code remotely. The critical vulnerability impacts installations spanning twelve years of releases, extending backward to GitLab version 7.0.

Regular Expression Integer Overflow and Onigmo Compiler Flaw

The critical security flaw originates from an integer overflow inside the regular expression compiler when evaluating specially crafted pattern inputs. Technical analysis shows that the root vulnerability resides within Onigmo, the native Ruby regular expression engine bundled with Ruby runtimes. GitLab evaluated the issue with the CVSS vector score describing a network-accessible vector with low attack complexity, requiring zero user authentication and no interactive triggers. Security researcher joaxcar discovered and reported the critical defect through GitLab's coordinated HackerOne bug bounty program. Environments that previously applied maintenance updates released nine days earlier on October 12 remain vulnerable to this revised flaw.

On October 12, 2026, GitLab patched CVE-2026-97229, a critical CVSS 10.0 unauthenticated integer overflow in the regex compiler, according to The Hacker News.

Broad Version Backports and Multi-Flaw Remediation

The emergency security release resolves a total of twelve vulnerabilities across GitLab products, encompassing one critical, two high, five medium, and four low severity issues. Among the resolved flaws, five vulnerabilities affect Enterprise Edition instances exclusively, while the remaining seven weaknesses impact both Community Edition and Enterprise Edition codebases. GitLab delivered corrective security patches across seven distinct release branches, covering versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The company backported fixes to long-retired major versions due to the extraordinary severity of the underlying integer overflow vulnerability. GitLab strongly advised system administrators managing private enterprise servers to deploy updated releases without delay.

Authentication Bypass and OAuth Discovery Poisoning Risks

Alongside the primary RCE defect, the security advisory addresses CVE-2026-15723, a high-severity authentication flaw evaluated at CVSS 8.2. The maintenance release also mitigates CVE-2026-112212, a high-risk weakness rated 7.5 involving cache poisoning within OAuth and OIDC discovery endpoints. Exploitation of endpoint cache poisoning could permit malicious actors to manipulate identity provider endpoints and redirect user authentication workflows.

Deployment Operations, Cloud Mitigation, and Migration Planning

Similarly, GitLab Dedicated hosted cloud instances operating on version 19.3.5-internal0 and 19.4.2-internal0 or higher already incorporate the required mitigations. To assist enterprise defense teams in detecting exploitation, GitLab published specific threat detection rules titled Onigmo native worker crash and Org mode rendering timeout. System administrators planning deployments must accommodate database migrations included within versions 19.3.6 and 19.4.3, with version 19.4.3 including post-deployment tasks. Organizations operating single-node installations will experience operational service downtime during database migrations, whereas properly configured multi-node deployments can execute zero-downtime upgrades.