GitLab has patched a maximum-severity flaw that could let an unauthenticated user run code on a self-managed server, in a release that reaches back to versions first shipped more than a decade ago.

The flaw, tracked as CVE-2026-110264 and scored 10.0, the highest possible CVSS rating, is an integer overflow in GitLab's regular-expression compiler. GitLab said that under certain conditions it could allow an unauthenticated user to execute arbitrary code on the server. Fixed releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 were published on 21 October 2026 for Community Edition and Enterprise Edition.

Every self-managed release since 2014 in scope

Reporting of the advisory puts affected versions as starting at GitLab 7.0, released in 2014, with the trigger linked to rendering a crafted Org-mode (.org) file in a repository. That makes the scope wider than GitLab's earlier October regex flaw, CVE-2026-97229, which was already covered on this site and affected a narrower set of releases. Operators who installed that 12 October fix are therefore still exposed to this new flaw and need to upgrade again, to the fixed release for their own branch.

What operators should do now

GitLab.com already runs the fixed version, and GitLab Dedicated tenants on the specified patched internal releases do not need to act, so the urgent work falls on self-managed operators, starting with internet-facing instances. GitLab has not reported exploitation of this flaw, and it was not in CISA's Known Exploited Vulnerabilities catalogue in checks reported on 22 October. That absence should not be read as safety: a maximum-severity, unauthenticated flaw in widely deployed infrastructure is routinely studied once a patch is public. GitLab has also published two detection rules, covering Onigmo native worker crashes and Org-mode render error bursts, to help teams hunt their logs for exploitation attempts.