On October 21, 2026, GitLab released emergency versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 . They fix CVE-2026-110264 , a critical flaw rated 10.0 , the maximum score, which can allow an unauthenticated attacker to execute code on a GitLab server. It is the second flaw of this kind in ten days. Here is what happened, and what to do.

The problem comes from the regular expression engine

Both flaws share the same nature: an integer overflow when compiling a specially crafted regular expression. The component at fault is Onigmo , Ruby's regular expression engine, which GitLab ships in its packages.

CVE-2026-97229 (October 12): the malicious expression goes through the CI/CD configuration, in a .gitlab-ci.yml file. It affects versions 19.2 and later.

CVE-2026-110264 (October 21): a flaw of the same nature, but affecting every version since GitLab 7.0 , released in 2014.…