---
title: Hunt: GitLab CVE-2026-110264 — Onigmo worker crashes and org-mode render error bursts on self-managed instances | ctxsec
url: https://ctxsec.com/items/hunt-gitlab-cve-2026-110264
description: ""
status: "hunt idea (GitLab threat detections in Oct 21 patch notes)"
published: 2026-10-21
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-gitlab-cve-2026-110264.md)

hunt idea (GitLab threat detections in Oct 21 patch notes)

2026-10-21

### Hunt: GitLab CVE-2026-110264 — Onigmo worker crashes and org-mode render error bursts on self-managed instances

Until you finish upgrading past the Oct 21 fixed builds, watch for the two detections GitLab published with CVE-2026-110264:

1. **Onigmo native worker crashes** — sudden crashes in the Onigmo/regex native worker path while handling unauthenticated or anonymous requests that exercise regex compilation (CI lint, search, snippets, issue filters, etc.). Correlate with spikes of 5xx from unauthenticated clients.
2. **Org mode render error bursts** — clusters of org-mode rendering errors that can accompany malformed regex-driven render paths.
3. Inventory: list every self-managed CE/EE below 18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1; GitLab.com/Dedicated are already covered.
4. Do not confuse with CVE-2026-97229 (Oct 12) or the older path-traversal CVE-2026-85706 — different bugs, overlapping urgency for self-managed admins.

Sources: [GitLab Critical Patch Release notes (detections section)](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)