TL;DR

what: GitLab fixed CVE-2026-110264 on October 21, an integer overflow in its bundled Onigmo regular-expression engine that allows unauthenticated remote code execution.

impact: Every self-managed GitLab release since 7.0 (2014) is affected, including instances patched on October 12, and a compromised server exposes source code, CI/CD secrets and deploy credentials.

fix: GitLab released fixed versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and lists no interim workaround.

who: Organizations running self-managed GitLab; GitLab.com and GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later are already fixed.

On October 21, GitLab shipped fixes for CVE-2026-110264, a CVSS 10.0 flaw that lets an attacker run arbitrary code on a self-managed GitLab server without logging in. The bug affects every release since GitLab 7.0, which came out in 2014.…