Threat reportVulnerabilityTL-2026-4569
GitLab CE/EE max-severity unauthenticated code execution via regular expression compiler (Onigmo) integer overflow (CVE-2026-110264)
GitLab CE/EE max-severity unauthenticated code execution via (TL-2026-4569) is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-27. It has no confirmed attribution, affects GitLab GitLab Community Edition / Enterprise Edition (self-managed), references 1 CVE (CVE-2026-110264), maps to 5 MITRE ATT&CK techniques (T1059, T1190, T1213.003), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4569
- Threat ID
- TL-2026-4569
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, finance, government administration, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in GitLab CE/EE max-severity unauthenticated code execution via
Malware and tooling: PUMAKIT, Ruby
How GitLab CE/EE max-severity unauthenticated code execution via works
GitLab patched a CVSS 10.0 integer overflow in the Regular Expression Compiler that, under certain conditions, lets an unauthenticated user execute arbitrary code on self-managed GitLab CE/EE servers via a specially crafted regular expression. No in-the-wild exploitation, public PoC, or CISA KEV listing was reported as of 2026-10-22.
CVE-2026-110264 is an integer overflow (CWE-190) in the regular expression compiler used by GitLab CE/EE. GitLab states that under certain conditions the flaw could allow an unauthenticated user to execute arbitrary code on the GitLab server when a specially crafted regular expression is compiled. NVD scores it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and lists affected self-managed versions from 7.0 (June 2014) up to the fixed releases. The issue was reported by the researcher using the HackerOne handle 'joaxcar' through GitLab's bug bounty program (HackerOne report 4093475 per NVD).
Secondary analyses (GetAstra, an independent write-up at lilting.ch, and others) attribute the root cause to Onigmo, the regex engine bundled with Ruby: each counted repeat such as {0,100} receives a 'repeat ID' stored as a signed 16-bit value, and past 32,767 repeats the ID wraps negative, producing out-of-bounds memory writes. GitLab's patch release includes backports of a Ruby fix ('Reject overflowed repeat/null-check IDs in huge regexps', Ruby PR #16801) for Ruby 3.3, 3.4 and 4.0 on 19.2-19.5, and a repeat-range double-free patch for Ruby 3.3 and 3.4 on 18.11, 19.0 and 19.1. The specific trigger path is NOT stated by GitLab. One secondary source says .org (Org-mode) file rendering through the org-ruby gem's #+TODO: keyword handling is the trigger; another lists file previews, wikis, Markdown blobs and READMEs. Treat these trigger claims as unconfirmed secondary reporting.
GitLab published two detection signatures for self-managed instances, 'Onigmo native worker crash' and 'Org mode render error burst', and warns that successful exploitation does not reliably crash, so the absence of alerts does not prove an instance is clean. One secondary source suggests watching exceptions_json.log for repeated Timeout::Error entries on .org files; this is secondary guidance, not a vendor statement. No workaround is documented. GitLab.com is already patched, and GitLab Dedicated is covered. Versions fixed in the separate 2026-10-12 release (CVE-2026-97229, another CVSS 10.0 regex-related flaw reported by the same researcher) remain vulnerable to this CVE. Roughly 2,700 internet-exposed GitLab CE instances were reported by Shadowserver per BleepingComputer. Because GitLab hosts source code, CI/CD pipelines and deployment secrets, successful compromise would carry high downstream impact. No network IOCs (IPs, domains, hashes) have been published.
MITRE ATT&CK techniques used in TL-2026-4569
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Collection
T1213.003 Data from Information Repositories: Code Repositories
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation
Credential Access
Affected products and versions in GitLab CE/EE max-severity unauthenticated code execution via
- GitLab — GitLab Community Edition / Enterprise Edition (self-managed)
Vulnerable versions: 7.0 to <18.11.13; 19.0 to <19.0.10; 19.1 to <19.1.9; 19.2 to <19.2.9; 19.3 to <19.3.6; 19.4 to <19.4.3; 19.5.0
Fixed in: 18.11.13; 19.0.10; 19.1.9; 19.2.9; 19.3.6; 19.4.3; 19.5.1
Remediation for GitLab CE/EE max-severity unauthenticated code execution via
Patches
- GitLab CE/EE 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
Immediate actions
- Upgrade self-managed GitLab CE/EE to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13
- Reduce public exposure of the GitLab web UI (firewall/VPN) until patched
- Deploy GitLab's 'Onigmo native worker crash' and 'Org mode render error burst' detection rules
- Hunt for unusual child processes of Puma, Sidekiq and Workhorse
Workarounds
- No workaround documented by GitLab; restrict network access to the GitLab UI as a risk-reduction measure
- If compromise is suspected, rotate secrets, CI/CD variables, runner tokens and access tokens
Longer-term hardening
- Keep GitLab off the public internet where possible and isolate it at the network level
- Plan for migrations/downtime when upgrading to 19.4.3 and 19.3.6
- Monitor GitLab security release announcements for follow-on regex engine flaws
CVEs associated with GitLab CE/EE max-severity unauthenticated code execution via
Weaknesses (CWE) in GitLab CE/EE max-severity unauthenticated code execution via
Timeline of GitLab CE/EE max-severity unauthenticated code execution via
- GitLab 7.0 released; per NVD and secondary sources, all self-managed versions from 7.0 onward are affected.
- GitLab patches a separate CVSS 10.0 regex-related flaw, CVE-2026-97229; those fixed versions remain vulnerable to CVE-2026-110264.
- GitLab publishes detection rules ('Onigmo native worker crash', 'Org mode render error burst') for self-managed instances, per Rescana.
- GitLab releases critical patches 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 fixing CVE-2026-110264; GitLab.com already patched.
- Shadowserver tracks over 2,700 internet-exposed GitLab CE instances, per BleepingComputer.
- BleepingComputer and others report the max-severity flaw; NVD publishes CVE-2026-110264 with CVSS 10.0; no exploitation reported and not in CISA KEV.
- NVD record last modified; no exploitation or public PoC reported in the sources reviewed.
Sources cited for GitLab CE/EE max-severity unauthenticated code execution via
- GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
- GitLab warns of new max severity code execution vulnerability (BleepingComputer)
- NVD - CVE-2026-110264
- GitLab critical patches include one for a bug that allows code execution by unauthenticated users (CSO Online)
- CVE-2026-110264: GitLab's Critical CVSS 10.0 Regex RCE Explained (GetAstra)
- GitLab CVE-2026-110264 (CVSS 10.0) Lets Unauthenticated Attackers Run Code by Rendering an .org File
- GitLab CVE-2026-110264 unauthenticated RCE (Rescana)
- HackerOne report 4093475 (as cited by NVD)
Detection coverage for TL-2026-4569
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4569 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.