Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

What happened?

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an

Key details

• GitLab released fixes on October 21 for a critical unauthenticated remote code execution flaw affecting all versions back to 7.0 from 2014.
• The vulnerability is tracked as CVE-2026-110264 with a maximum CVSS score of 10.0 due to an integer overflow in the regex compiler.
• Only self-managed installations are affected; GitLab.com and GitLab Dedicated tenants on specific internal releases already have the fix.
• GitLab fixed the flaw in seven versions at once, including backports to older branches beyond normal support policy.
• The root cause is a weakness in the Onigmo regular-expression engine shipped inside GitLab packages since version 7.0.
• GitLab published two Sigma detection rules for exploitation attempts: Onigmo native worker crash and Org mode render error burst.
• This is the fourth regex engine code-execution flaw reported by researcher joaxcar in a month, and the first to affect versions before 19.2.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.