---
title: GitLab critical patch: CVE-2026-110264 CVSS 10.0 unauthenticated RCE via regex compiler (affects CE/EE since 7.0) | ctxsec
url: https://ctxsec.com/items/gitlab-cve-2026-110264-regex-rce
description: ""
status: "confirmed (GitLab critical patch release Oct 21); no public ITW claim yet; not on CISA KEV as of catalog 2026.10.21"
published: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/gitlab-cve-2026-110264-regex-rce.md)

confirmed (GitLab critical patch release Oct 21); no public ITW claim yet; not on CISA KEV as of catalog 2026.10.21

2026-10-21

### GitLab critical patch: CVE-2026-110264 CVSS 10.0 unauthenticated RCE via regex compiler (affects CE/EE since 7.0)

On Oct 21 GitLab released **19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13** for CE/EE. The headline fix is **CVE-2026-110264**: an integer overflow in the regular-expression compiler that, under certain conditions, could let an **unauthenticated** user run arbitrary code on the GitLab server (CVSS 10.0, `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`). Impacted: all versions from **7.0** before the fixed builds above (roughly 12 years of releases). GitLab.com is already patched; Dedicated tenants on 19.3.5-internal0 / 19.4.2-internal0 or later include the fix. GitLab also shipped threat detections for Onigmo native worker crashes and org-mode render error bursts. Same release includes high-severity OmniAuth-to-LDAP account takeover (CVE-2026-15723) and OAuth/OIDC discovery cache poisoning (CVE-2026-112212), plus several mediums. This is a **different** bug from the Oct 12 CI/CD regex RCE CVE-2026-97229 already on this site. **Do now:** upgrade self-managed instances immediately; do not assume last week's patch covers this one.

Sources: [GitLab Critical Patch Release: 19.5.1…18.11.13](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) · [The Hacker News summary](https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html)