Affected Systems

GitLab self-managed installations versions 7.0 (2014) through 19.5.0. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated already patched. CVE-2026-110264 stems from integer overflow in bundled Onigmo regex engine during compilation of crafted regular expressions.

Exploitation Status

No evidence of active exploitation as of October 22, 2026. Not listed in CISA KEV catalog. GitLab has published two Sigma detection rules ("Onigmo native worker crash" and "Org mode render error burst") in their TLDR framework to hunt for exploitation attempts in application logs. Preconditions for exploitation not disclosed by vendor.

Business Impact

Unauthenticated remote code execution with maximum CVSS 10.0 severity affects 12 years of GitLab releases. Administrators who patched on October 12 (CVE-2026-97229) remain vulnerable, as that fix only covered 19.2+. No workaround available; patching is the only mitigation. Upgrades to 19.4.3 and 19.3.6 include database migrations causing downtime on single-node deployments. Multi-node environments can use zero-downtime procedures. Vendor has not disclosed attack preconditions, so configuration-based risk assessment is not possible.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all self-managed GitLab instances to fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 depending on current branch
  • Plan for downtime during upgrade on single-node servers due to database migrations in 19.4.3 and 19.3.6; use GitLab zero-downtime procedure for multi-node setups
  • Deploy GitLab TLDR Sigma detection rules 'Onigmo native worker crash' and 'Org mode render error burst' against application logs to hunt for exploitation attempts
  • Verify GitLab Dedicated tenants are on internal releases 19.3.5-internal0, 19.4.2-internal0, or later; GitLab.com users require no action
  • Monitor GitLab security advisories for disclosure of attack preconditions and additional indicators of compromise as vendor releases more information