Threat reportVulnerabilityTL-2026-4063
Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0): Unauthenticated RCE via Onigmo Regex Integer Overflow Across GitLab 7.0-19.5
Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0) (TL-2026-4063), also tracked as GitLab Onigmo regex integer overflow, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-21 and last reviewed 2026-10-22. It has no confirmed attribution, affects GitLab GitLab Community Edition (CE) and Enterprise Edition (EE), references 4 CVEs (CVE-2026-110264, CVE-2026-97229, CVE-2026-15723), maps to 7 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4063
- Threat ID
- TL-2026-4063
- Also known as
- GitLab Onigmo regex integer overflow
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, government administration, finance, telecoms, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
- Updates
- 2026-10-22 · revalidated 1× · latest source
Malware and tooling in Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0)
Malware and tooling: PUMAKIT, Ruby, Onigmo
How Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0) works
An integer overflow in the Onigmo regular-expression compiler shipped with GitLab CE/EE lets an unauthenticated attacker execute arbitrary code on the server via a specially crafted regular expression, under conditions GitLab has not disclosed. Self-managed GitLab 7.0 through 19.5 is affected; GitLab.com and Dedicated are already patched. No in-the-wild exploitation, public PoC, or CISA KEV listing was reported at publication.
CVE-2026-110264 is a critical (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) integer overflow in the regular-expression compiler of Onigmo, the Ruby regex engine that GitLab ships and patches inside its own packages. GitLab's advisory states that, under certain conditions, an unauthenticated user can execute arbitrary code on the GitLab server by causing a specially crafted regular expression to be compiled. The vulnerable component is present in every release since GitLab 7.0 (2014), so the affected range spans roughly 12 years of releases: all GitLab CE/EE from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.
GitLab has not disclosed the exploitation preconditions, so administrators cannot rule themselves out through configuration alone. The issue was reported by the researcher 'joaxcar' through GitLab's HackerOne bug bounty program. Per The Hacker News, the same researcher reported this and three prior regex-engine flaws within one month. The October 21, 2026 patch release also fixed 10 other vulnerabilities, including an OmniAuth-to-LDAP auto-linking authentication issue (CVE-2026-15723, CVSS 8.2) and cache poisoning in OAuth/OIDC (CVE-2026-112212, CVSS 7.5).
Related context (a different CVE, not evidence about this one): the immediately preceding critical GitLab fix, CVE-2026-97229 (CWE-190, CVSS 10.0, patched October 12, 2026 in 19.2.8/19.3.5/19.4.2), is also an Onigmo integer overflow. Rapid7 independently reproduced code execution for it. In that chain, attacker-controlled repository paths reach the Onigmo compiler via CI rules:exists:regexp / rules:changes:regexp evaluated through the unauthenticated CI lint API. A quantifier hidden by an inline comment ({5(?#)7805}) bypasses validation and expands to {57805}. The overflowing program-size calculation (37,151 x 57,805 = 2,147,513,555) exceeds INT_MAX. Execution then redirects Onigmo's backtracking stack and a native return pointer to system(), yielding code execution as the git user. Defenders should treat CVE-2026-110264 as part of the same bug class and a likely candidate for similar exposure, but its specific trigger conditions have not been published.
No threat actor, campaign, or network IOCs have been reported. GitLab published two Sigma detection rules through the open-source TLDR framework, 'Onigmo native worker crash' and 'Org mode render error burst', which monitor GitLab application logs. Upgrades involve database changes that cause downtime on single-node servers; multi-node deployments can use zero-downtime procedures.
MITRE ATT&CK techniques used in TL-2026-4063
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access
Collection
Impact
T1499.004 Application or System Exploitation
Resource Development
Affected products and versions in Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0)
- GitLab — GitLab Community Edition (CE) and Enterprise Edition (EE), self-managed
Vulnerable versions: 7.0 through 18.11.12; 19.0 before 19.0.10; 19.1 before 19.1.9; 19.2 before 19.2.9; 19.3 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1
Fixed in: 18.11.13; 19.0.10; 19.1.9; 19.2.9; 19.3.6; 19.4.3; 19.5.1
Remediation for Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0)
Patches
- GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (released 2026-10-21)
- GitLab Dedicated internal releases 19.3.5-internal0+ and 19.4.2-internal0+ are protected; GitLab.com is already patched
Immediate actions
- Upgrade self-managed GitLab CE/EE to a fixed release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13
- Treat all self-managed instances in the 7.0-19.5 range as exposed; configuration cannot be used to rule out exposure because GitLab has not disclosed the preconditions
- Deploy GitLab's Sigma rules 'Onigmo native worker crash' and 'Org mode render error burst' against GitLab application logs
- Hunt for Puma/Sidekiq worker crashes and bursts of HTTP 502 responses from the GitLab web tier
Workarounds
- No vendor workaround was identified in the source; for the related CVE-2026-97229 Rapid7 advised restricting anonymous access to public projects and preventing untrusted users from creating repositories (not confirmed as effective for CVE-2026-110264)
Longer-term hardening
- Keep self-managed GitLab on a supported release branch with a fast critical-patch SLA
- Restrict internet exposure of GitLab to VPN or allowlisted networks where feasible
- Run GitLab services as a least-privileged user and monitor the git user for anomalous child processes
CVEs associated with Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0)
CVE-2026-110264, CVE-2026-97229, CVE-2026-15723, CVE-2026-112212
Weaknesses (CWE) in Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0)
Timeline of Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0)
- GitLab ships an earlier critical patch release (19.2.4, 19.1.6, 19.0.8, 18.11.11), the start of a run of critical GitLab fixes in 2026.
- Two earlier regular-expression flaws in GitLab are patched (per Konfirmity).
- GitLab patches the related Onigmo integer overflow CVE-2026-97229 (CVSS 10.0) in 19.4.2, 19.3.5 and 19.2.8; this fix covered only versions 19.2 and later.
- Rapid7 publishes technical analysis of CVE-2026-97229 and reports independent reproduction of code execution on unpatched GitLab CE; no in-the-wild exploitation reported.
- CSA Singapore publishes alert AL-2026-141 for the related CVE-2026-97229.
- Rapid7 updates its CVE-2026-97229 advisory.
- The Hacker News reports the flaw as affecting 12 years of GitLab releases; no active exploitation, public PoC or KEV listing at publication.
- GitLab publishes Sigma rules 'Onigmo native worker crash' and 'Org mode render error burst' via the TLDR framework; GitLab.com and Dedicated already run fixed versions.
- GitLab releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, fixing CVE-2026-110264 (CVSS 10.0) plus 11 other vulnerabilities.
- NVD publishes CVE-2026-110264 (CVSS 10.0, CWE-190); Cyber Security News reports no confirmed attacks and no public exploit.
Update history for TL-2026-4063
- 2026-10-22 — 12-Year-Old GitLab Vulnerability (CVE-2026-110264) Allows Unauthenticated Remote Code Execution on Self-Managed Servers: What changed No severity, exploitability or status escalation. Exploitation remains unconfirmed and no public PoC exists as of 2026-10-22. The newer report lists status PATCHED, but the existing record already reflects the 2026-10-21 fix, s
Sources cited for Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0)
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
- GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6 (CVE-2026-110264 advisory)
- GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8 (related CVE-2026-97229)
- Rapid7 ETR: CVE-2026-97229 Critical Unauthenticated Remote Code Execution in GitLab (related bug class)
- Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) technical analysis
- Patch now: GitLab publishes fixes for perfect-10 vulnerability CVE-2026-97229
- SOCRadar: CVE-2026-97229 Critical GitLab RCE
- Vulert: CVE-2026-97229 GitLab Integer Overflow Vulnerability Leading to Arbitrary Code Execution
Detection coverage for TL-2026-4063
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4063 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.