# Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0): Unauthenticated RCE via Onigmo Regex Integer Overflow Across GitLab 7.0-19.5

> An integer overflow in the Onigmo regular-expression compiler shipped with GitLab CE/EE lets an unauthenticated attacker execute arbitrary code on the server via a specially crafted regular expression, under conditions GitLab has not disclosed. Self-managed GitLab 7.0 through 19.5 is affected; GitLab.com and Dedicated are already patched. No in-the-wild exploitation, public PoC, or CISA KEV listing was reported at publication.

- **Published:** 2026-10-21T21:19:04Z
- **Last reviewed:** 2026-10-22T02:14:08.002Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4063
- **ID:** TL-2026-4063
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-110264, CVE-2026-97229, CVE-2026-15723, CVE-2026-112212

## Description

CVE-2026-110264 is a critical (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) integer overflow in the regular-expression compiler of Onigmo, the Ruby regex engine that GitLab ships and patches inside its own packages. GitLab's advisory states that, under certain conditions, an unauthenticated user can execute arbitrary code on the GitLab server by causing a specially crafted regular expression to be compiled. The vulnerable component is present in every release since GitLab 7.0 (2014), so the affected range spans roughly 12 years of releases: all GitLab CE/EE from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.

GitLab has not disclosed the exploitation preconditions, so administrators cannot rule themselves out through configuration alone. The issue was reported by the researcher 'joaxcar' through GitLab's HackerOne bug bounty program. Per The Hacker News, the same researcher reported this and three prior regex-engine flaws within one month. The October 21, 2026 patch release also fixed 10 other vulnerabilities, including an OmniAuth-to-LDAP auto-linking authentication issue (CVE-2026-15723, CVSS 8.2) and cache poisoning in OAuth/OIDC (CVE-2026-112212, CVSS 7.5).

Related context (a different CVE, not evidence about this one): the immediately preceding critical GitLab fix, CVE-2026-97229 (CWE-190, CVSS 10.0, patched October 12, 2026 in 19.2.8/19.3.5/19.4.2), is also an Onigmo integer overflow. Rapid7 independently reproduced code execution for it. In that chain, attacker-controlled repository paths reach the Onigmo compiler via CI rules:exists:regexp / rules:changes:regexp evaluated through the unauthenticated CI lint API. A quantifier hidden by an inline comment ({5(?#)7805}) bypasses validation and expands to {57805}. The overflowing program-size calculation (37,151 x 57,805 = 2,147,513,555) exceeds INT_MAX. Execution then redirects Onigmo's backtracking stack and a native return pointer to system(), yielding code execution as the git user. Defenders should treat CVE-2026-110264 as part of the same bug class and a likely candidate for similar exposure, but its specific trigger conditions have not been published.

No threat actor, campaign, or network IOCs have been reported. GitLab published two Sigma detection rules through the open-source TLDR framework, 'Onigmo native worker crash' and 'Org mode render error burst', which monitor GitLab application logs. Upgrades involve database changes that cause downtime on single-node servers; multi-node deployments can use zero-downtime procedures.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1213.003 Code Repositories
- T1499.004 Application or System Exploitation
- T1588.006 Vulnerabilities
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access

## Sources

- [Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases](https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html)
- [GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6 (CVE-2026-110264 advisory)](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)
- [GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8 (related CVE-2026-97229)](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)
- [Rapid7 ETR: CVE-2026-97229 Critical Unauthenticated Remote Code Execution in GitLab (related bug class)](https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab)
- [Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) technical analysis](https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229)
- [Patch now: GitLab publishes fixes for perfect-10 vulnerability CVE-2026-97229](https://www.cyberdaily.au/security/14302-patch-now-gitlab-publishes-fixes-for-perfect-10-vulnerability-cve-2026-97229)
- [SOCRadar: CVE-2026-97229 Critical GitLab RCE](https://socradar.io/blog/cve-2026-97229-critical-gitlab-rce/)
- [Vulert: CVE-2026-97229 GitLab Integer Overflow Vulnerability Leading to Arbitrary Code Execution](https://vulert.com/vuln-db/CVE-2026-97229)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4063