GitLab CE/EE (self-managed) at a glance
GitLab's October 21, 2026 critical patch (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) fixes CVE-2026-110264, an integer overflow when compiling crafted regular expressions that could let an unauthenticated attacker run code on self-managed servers. GitLab.com is already patched.
GitLab CE/EE (self-managed): status
- Affected
- GitLab CE/EE from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1 (CVE-2026-110264)
- Self-managed GitLab installs with their own Ruby runtime older than 3.3.13, 3.4.12 or 4.0.9
- Ruby applications that compile regular expressions from untrusted input on Ruby versions before 3.3.13, 3.4.12 or 4.0.9
- CVE identifiers
- Status as of
- Discovered by
- Johan Carlsson (joaxcar) via GitLab's HackerOne bug bounty program
What changed with GitLab CE/EE (self-managed)
On October 21, 2026, GitLab shipped a critical patch release for Community and Enterprise Edition. Its headline fix, CVE-2026-110264, is rated CVSS 3.1 10.0: under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server because of an integer overflow when compiling a specially crafted regular expression. Every version from 7.0 is affected until the fixed builds 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. The report came from researcher joaxcar through GitLab's HackerOne bug bounty; the credits do not mention AI.
The root cause is in Onigmo, the regex engine inside Ruby. On October 23, Ruby released 4.0.9, 3.4.12 and 3.3.13 with fixes for four GitLab-assigned CVEs, including this one. GitLab.com is patched, and GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 or later need no action. Self-managed installs that use their own Ruby runtime, such as self-compiled setups or custom container images, must also upgrade Ruby. GitLab lists no workaround and published two threat detections for self-managed instances.
The same release fixes eleven more CVEs, including two high-severity issues fixed only in 19.3.6, 19.4.3 and 19.5.1: OmniAuth-to-LDAP auto-linking authentication (CVE-2026-15723, CVSS 8.2) and cache poisoning on OAuth/OIDC discovery endpoints (CVE-2026-112212, CVSS 7.5). Two lower-severity bugs touch AI features: an AI Gateway header that could enable paid AI features without a subscription (CVE-2026-112378) and a Duo admin lock for Amazon Q that could be bypassed (CVE-2026-103515). As of November 5, CISA had not listed CVE-2026-110264 as exploited.
How to fix it: GitLab CE/EE (self-managed)
1. Update
Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13 as soon as possible; older lines need an upgrade path to a supported fixed release.
docs.gitlab.com (opens in a new tab)2. Update
If GitLab runs on its own Ruby (self-compiled or custom images), also upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later.
ruby-lang.org (opens in a new tab)3. Workaround
For other Ruby apps that cannot upgrade yet, avoid compiling regular expressions from untrusted input.
ruby-lang.org (opens in a new tab)4. Monitor
Use GitLab's two published threat detections for self-managed instances, Onigmo native worker crash and Org mode render error burst.
docs.gitlab.com (opens in a new tab)
Advisories
Why GitLab CE/EE (self-managed) matters for businesses
Self-hosted GitLab often holds a company's source code, CI/CD secrets and deploy keys, and it is the system AI coding agents read from and push to, so a no-login RCE puts all of that at risk. Ruby notes that any app compiling regexes from attacker-controlled strings, through Regexp.new, Regexp.union or interpolation, is exposed too, and Regexp.timeout does not help. If you run Ruby services that build patterns from user or model-generated text, upgrade Ruby as well.
Sources for this story
- GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (opens in a new tab)Official
GitLab · docs.gitlab.com
- CVE-2026-110264: Integer Overflow or Wraparound in GitLab (opens in a new tab)Official
CVE Program · cve.org
- Regexp fixes for GitLab CVEs (opens in a new tab)Official
Ruby · ruby-lang.org
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #gitlab
- #ruby
- #remote-code-execution
- #self-hosting
- #devops