# GitLab CE/EE max-severity unauthenticated code execution via regular expression compiler (Onigmo) integer overflow (CVE-2026-110264)

> GitLab patched a CVSS 10.0 integer overflow in the Regular Expression Compiler that, under certain conditions, lets an unauthenticated user execute arbitrary code on self-managed GitLab CE/EE servers via a specially crafted regular expression. No in-the-wild exploitation, public PoC, or CISA KEV listing was reported as of 2026-10-22.

- **Published:** 2026-10-27T21:09:51Z
- **Last reviewed:** 2026-10-27T21:09:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4569
- **ID:** TL-2026-4569
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-110264

## Description

CVE-2026-110264 is an integer overflow (CWE-190) in the regular expression compiler used by GitLab CE/EE. GitLab states that under certain conditions the flaw could allow an unauthenticated user to execute arbitrary code on the GitLab server when a specially crafted regular expression is compiled. NVD scores it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and lists affected self-managed versions from 7.0 (June 2014) up to the fixed releases. The issue was reported by the researcher using the HackerOne handle 'joaxcar' through GitLab's bug bounty program (HackerOne report 4093475 per NVD).

Secondary analyses (GetAstra, an independent write-up at lilting.ch, and others) attribute the root cause to Onigmo, the regex engine bundled with Ruby: each counted repeat such as {0,100} receives a 'repeat ID' stored as a signed 16-bit value, and past 32,767 repeats the ID wraps negative, producing out-of-bounds memory writes. GitLab's patch release includes backports of a Ruby fix ('Reject overflowed repeat/null-check IDs in huge regexps', Ruby PR #16801) for Ruby 3.3, 3.4 and 4.0 on 19.2-19.5, and a repeat-range double-free patch for Ruby 3.3 and 3.4 on 18.11, 19.0 and 19.1. The specific trigger path is NOT stated by GitLab. One secondary source says .org (Org-mode) file rendering through the org-ruby gem's #+TODO: keyword handling is the trigger; another lists file previews, wikis, Markdown blobs and READMEs. Treat these trigger claims as unconfirmed secondary reporting.

GitLab published two detection signatures for self-managed instances, 'Onigmo native worker crash' and 'Org mode render error burst', and warns that successful exploitation does not reliably crash, so the absence of alerts does not prove an instance is clean. One secondary source suggests watching exceptions_json.log for repeated Timeout::Error entries on .org files; this is secondary guidance, not a vendor statement. No workaround is documented. GitLab.com is already patched, and GitLab Dedicated is covered. Versions fixed in the separate 2026-10-12 release (CVE-2026-97229, another CVSS 10.0 regex-related flaw reported by the same researcher) remain vulnerable to this CVE. Roughly 2,700 internet-exposed GitLab CE instances were reported by Shadowserver per BleepingComputer. Because GitLab hosts source code, CI/CD pipelines and deployment secrets, successful compromise would carry high downstream impact. No network IOCs (IPs, domains, hashes) have been published.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1552 Unsecured Credentials
- T1213.003 Data from Information Repositories: Code Repositories

## Sources

- [GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)
- [GitLab warns of new max severity code execution vulnerability (BleepingComputer)](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/)
- [NVD - CVE-2026-110264](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-110264)
- [GitLab critical patches include one for a bug that allows code execution by unauthenticated users (CSO Online)](https://www.csoonline.com/article/4239289/gitlab-critical-patches-include-one-for-a-bug-that-allows-code-execution-by-unauthenticated-users-2.html)
- [CVE-2026-110264: GitLab's Critical CVSS 10.0 Regex RCE Explained (GetAstra)](https://www.getastra.com/blog/security-advisory/cve-2026-110264-explained/)
- [GitLab CVE-2026-110264 (CVSS 10.0) Lets Unauthenticated Attackers Run Code by Rendering an .org File](https://lilting.ch/en/articles/gitlab-cve-2026-110264-org-mode-rce)
- [GitLab CVE-2026-110264 unauthenticated RCE (Rescana)](https://www.rescana.com/post/gitlab-cve-2026-110264-unauthenticated-rce-october-2026)
- [HackerOne report 4093475 (as cited by NVD)](https://hackerone.com/reports/4093475)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4569