Gitlab Fixes 12-Year Critical Bug Enabling Remote Code Execution

WHO:

Techmeme - Swati Khandelwal reported on GitLab’s security fix.

The Hacker News - GitLab issued the fixes; the flaw affects self-managed GitLab installations. GitLab.com already runs a fixed version.

The Hacker News - GitLab Dedicated tenants using internal releases 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix.

The Hacker News - The researcher who reported the flaw uses the handle “joaxcar.”

WHAT:

Techmeme - GitLab patched a critical flaw that could let unauthenticated attackers run code on self-managed servers; it affects every release since version 7.0.

The Hacker News - The flaw, CVE-2026-110264, has a CVSS score of 10.0, the maximum, and could allow an unauthenticated user to run arbitrary code on a server.

The Hacker News - Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The last version covers installations from 7.0 through 18.11.

The Hacker News - The release addressed 11 security issues: one critical and the rest high, medium, or low.

The Hacker News - GitLab said it had no indication the flaw had been used in attacks. As of October 22, it was not listed in the U.S. CISA catalog of known exploited vulnerabilities.

The Hacker News - GitLab published two detection rules, “Onigmo native worker crash” and “Org mode render error burst,” for its open-source TLDR framework.

The Hacker News - The same researcher reported four code-execution flaws in GitLab’s regular-expression engine in a month; this was the first to affect versions earlier than 19.2.

WHERE:

The Hacker News - The vulnerability affects self-managed GitLab servers; GitLab.com and qualifying GitLab Dedicated installations already had the fix.

WHEN:

The Hacker News - GitLab released the fixes on October 21. The affected version range dates back to GitLab 7.0, released in 2014.

The Hacker News - An October 12 update fixed only versions 19.2 and later; administrators who installed it need another update.

The Hacker News - GitLab fixed CVE-2026-97229 on October 12 and CVE-2026-93577 and CVE-2026-89078 on September 23.

WHY:

The Hacker News - The vulnerability stems from an integer overflow during compilation of a specially crafted regular expression. GitLab has not disclosed the conditions required for exploitation.

The Hacker News - The issue spans releases because GitLab ships Ruby’s Onigmo regular-expression engine in its packages and patches it in its builds.

HOW:

The Hacker News - GitLab backported the fix to 18.11.13, 19.0.10, 19.1.9, and 19.2.9, beyond its usual policy of patching the current and previous two monthly releases.

The Hacker News - GitLab’s advisory provides no interim workaround; the company says installing the fix is the certain protection. Detection rules use Sigma format against GitLab application logs.

The Hacker News - Releases 19.4.3 and 19.3.6 include database changes that cause downtime on single-node servers while they run; multi-node setups can use GitLab’s zero-downtime procedure.

The Hacker News - Other addressed flaws included CVE-2026-15723, rated 8.2, which could enable account takeover when both SAML and LDAP auto-linking are enabled, and CVE-2026-112212, rated 7.5, a cache-poisoning flaw affecting OAuth and OpenID Connect sign-in flows using a shared cache.

(UPDATED October 22, 2026 02:17 UTC)

GitLab has patched a critical vulnerability that could let an unauthenticated attacker run arbitrary code on self-managed servers. Rated 10 out of 10, the flaw affects every release since version 7.0 and stems from an integer overflow when compiling a specially crafted regular expression. GitLab says it has no indication the vulnerability was used in attacks, but installing a fixed release is the only certain protection; no workaround is available. Administrators should update to one of the patched versions, including 19.5.1, 19.4.3, 19.3.6, or the corresponding fixes for older releases. An earlier update covered only versions 19.2 and later, so affected administrators who installed it need to update again. GitLab.com and qualifying GitLab Dedicated installations already have the fix. The release also addresses 10 other security issues, including flaws involving account takeover and sign-in cache poisoning. For some single-node systems, installing the update will require downtime.