arkknight

← intel

Intel Drop 09 | GitLab CVE-2026-110264: CVSS 10.0, 12 years deep

intel-drop · TLP:CLEAR · 22 Oct 2026 · Risk 15/25 (L3 × I5)

T1190T1059.004T1213.003

On 21 October, GitLab fixed CVE-2026-110264, rated CVSS 10.0. Under conditions GitLab hasn’t disclosed, an attacker without an account could run code on a self-managed GitLab server. The cause is an integer overflow when Ruby’s Onigmo regex engine compiles a crafted expression. Every release since 7.0 (2014) is affected.

Two points matter. First, servers patched for the similar CVE-2026-97229 on 12 October are still exposed. Second, this is the fourth regex-engine code-execution bug the same researcher has reported to GitLab in about a month. A GitLab flaw last month drew probes within hours of disclosure. GitLab reports no exploitation of this one so far, and there’s no interim workaround. GitLab.com is already patched.

For GCC government and critical-infrastructure teams, a self-managed GitLab often holds source code, CI/CD secrets and deploy keys. That makes it a supply-chain target.

Attack path

  1. Crafted regex reaches the GitLab server (T1190)
  2. Integer overflow in Ruby’s Onigmo engine (CVE-2026-110264)
  3. Code runs as the git user (T1059.004)
  4. Source code and CI secrets exposed (T1213.003)

Risk

15/25 CRITICAL (likelihood 3 × impact 5).

Confidence

Assessment Confidence
Exploitation within 30 days MODERATE

Business risk

One unpatched server could hand an attacker your code, your pipeline secrets and a route into production. Patching also means downtime on single-node servers.

What to do now

  • Upgrade to 19.5.1, 19.4.3 or 19.3.6, or to the 19.2.9, 19.1.9, 19.0.10 or 18.11.13 backports.
  • Re-check servers patched on 12 October. They need this update too.
  • Take internet-facing GitLab off the public internet until it is patched.
  • Review GitLab logs for crashes in the regex engine.

Sources

  1. GitLab Critical Patch Release 19.5.1 (21 Oct 2026): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
  2. The Hacker News (21 Oct 2026): https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
  3. HOL Guard research record (21 Oct 2026): https://hol.org/guard/security/campaigns/cve-2026-110264-gitlab-onigmo-regex-unauthenticated-rce
  4. The Hacker News, CVE-2026-97229 (background, 13 Oct 2026): https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html