If you run GitLab yourself, this is a drop-everything patch, and the trap is thinking you already did it. GitLab shipped a CVSS 10 unauthenticated RCE fix on October 21, 2026, and the patch many teams applied nine days earlier does not cover it. This post gives you the version table, the exact upgrade sequence, and the verification step most teams skip.

What actually happened

On October 21, 2026, GitLab shipped a critical patch release fixing CVE-2026-110264, an integer overflow in its regular expression compiler that GitLab rates CVSS 10.0. GitLab says that under certain conditions, a specially crafted regular expression could allow an unauthenticated user to execute arbitrary code on a self-managed GitLab server.

The flaw sits in Onigmo, the regular expression engine Ruby ships, which GitLab bundles inside its own packages.

The scope is what makes this one unusual. The affected range starts at GitLab 7.0, from 2014, and covers every self-managed CE and EE release below the fixed version for its branch.…