/
← Voltar ao feed
critical technology software_development

GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE rooted in the Onigmo regex engine, as Ruby ships upstream fixes

5 fonte(s) · 6 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 13 minutos

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 23/10/2026 15:01; os links antigos trazem para cá.

Fontes: thehackernews.com ×2 ↗ theregister.com ↗ bleepingcomputer.com ↗ gbhackers.com ↗ docs.gitlab.com ↗

GitLab released critical patch versions on October 21, 2026 for CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler of GitLab CE/EE. A specially crafted expression could let an unauthenticated attacker run arbitrary code on a self-managed server (docs.gitlab.com). Affected releases go back to version 7.0 (June 2014). Fixes ship in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab reports no in-the-wild exploitation, and none of the four related GitLab regex CVEs was in the CISA KEV catalog as of October 23 (thehackernews.com). The Register expects scanning for vulnerable instances to start soon (theregister.com). Shadowserver tracks over 2,700 internet-exposed GitLab CE instances, without saying how many are honeypots or already patched (bleepingcomputer.com). Administrators who patched CVE-2026-97229 on October 12 must upgrade again, because that fix covered only 19.2 and later (thehackernews.com). The researcher reported the flaw through HackerOne. Ruby has since released 4.0.9, 3.4.12 and 3.3.13 to fix the three underlying Onigmo bugs, so any Ruby application that compiles regular expressions from attacker-controlled text is affected, not only GitLab (thehackernews.com).

Entenda a falha

A vulnerabilidade

CVE-2026-110264 (CVSS 10.0, AV:N/AC:L/PR:N/UI:N) is an integer overflow in the regular expression compiler of GitLab CE/EE. Under conditions GitLab has not disclosed, an unauthenticated remote attacker could run arbitrary code on a self-managed server. Every version from 7.0 is affected; fixes are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and no workaround exists. GitLab.com is already patched. The release also fixes CVE-2026-15723 (8.2, SAML/LDAP account takeover by an authenticated user when auto-linking is on) and CVE-2026-112212 (7.5, OAuth/OIDC discovery cache poisoning), plus lower-severity access-control and information-leak flaws (CVE-2026-12664, 16255, 105777, 13319, 112378, 105711, 14288, 112326, 103515).

Como funciona

GitLab uses a regular expression engine to parse and validate expressions. The Hacker News says this is Ruby's Onigmo engine, which GitLab bundles in its own packages. When a specially crafted expression reaches the compiler, a size or count calculation overflows during compilation, and GitLab says this can end in code execution on the server. GitLab has not said how an unauthenticated attacker gets an expression to the compiler, so no one can rule themselves out by configuration. The two detections it published, 'Onigmo native worker crash' and 'Org mode render error burst', indicate which log signals to hunt for.

Por que é vulnerável

The root cause is an integer overflow when the regex engine compiles a crafted pattern, so a numeric value exceeds what the compiler expects. According to The Hacker News, the weakness is in Onigmo itself, which GitLab ships and patches in its own builds, so it exists in every release since 7.0. That explains the age of the affected range. The release also adds patches for a Ruby regexp repeat ID overflow and a double-free for Ruby 3.3, 3.4 and 4.0. The articles do not detail what the fix changes in the compiler.

Onde está

No file, function or commit is named; the articles only point to the Onigmo regular expression engine that GitLab bundles and patches in its own packages.

Como foi descoberta

The flaw was reported through GitLab's HackerOne bug bounty program. GitLab, The Hacker News, GBHackers and BleepingComputer credit the handle joaxcar, while The Register names Johan Carlsson; the articles do not say whether they are the same person. The Hacker News says the same researcher reported the earlier regex-engine flaws CVE-2026-97229 (October 12), CVE-2026-93577 and CVE-2026-89078 (September 23). GitLab disclosed it in the October 21 patch release and says issue details become public 90 days later. It reports no exploitation, and the flaw was not in the CISA KEV catalog as of October 22.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:23.

Detalhes técnicos

  • CVE-2026-110264 (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): integer overflow when compiling a crafted regular expression, leading to RCE (docs.gitlab.com, gbhackers.com).
  • Root cause: the Onigmo regex engine, which GitLab bundles and patches in its own packages (thehackernews.com). The release also adds Ruby regexp repeat ID overflow and double-free patches for Ruby 3.3, 3.4 and 4.0 (docs.gitlab.com).
  • Upstream: Ruby fixed three Onigmo memory-corruption bugs behind four GitLab CVEs issued between September 23 and October 21. GitLab fixed each by shipping a patched Ruby (thehackernews.com).
  • Ruby says an application is affected only if it passes an attacker-controlled string to Regexp.new, Regexp.union or Regexp.compile, or interpolates it into a pattern such as /#{input}/. Applications using only developer-written patterns are not affected (thehackernews.com).
  • Ruby has not requested CVE IDs of its own "at least for now" and points users to GitLab's four CVEs. GitLab's CVE records name only GitLab as the affected product, so scanners matching CVEs against installed Ruby versions will miss vulnerable Ruby installs. Ruby's documentation still describes untrusted patterns only as a denial-of-service risk (thehackernews.com).
  • GitLab has not stated the preconditions an attacker needs to reach the compiler, so administrators cannot rule themselves out by configuration (thehackernews.com). The Register says only that exploitation works "under certain conditions". The Hacker News notes that GitLab compiles user-supplied patterns such as those in CI/CD configuration.
  • The fix is backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9, beyond the normal policy of the current and previous two releases (thehackernews.com).
  • Related earlier flaws, all reported by the same researcher (thehackernews.com):
    • CVE-2026-97229 (CVSS 10.0, unauthenticated), fixed October 12 in 19.2.8, 19.3.5 and 19.4.2.
    • CVE-2026-93577 and CVE-2026-89078 (both CVSS 9.9, authenticated), fixed September 23.
    • CVE-2026-110264 is the first of these to reach versions before 19.2.
  • GitLab published two detections for self-managed instances, "Onigmo native worker crash" and "Org mode render error burst" (Sigma rules in its TLDR framework per thehackernews.com). They support investigating attempts and are not confirmation of an active campaign (gbhackers.com).
  • SOC Prime warns that a compromise could expose source code, CI/CD configuration, deployment secrets, access tokens and infrastructure definitions. That would enable credential theft, repository manipulation, supply chain attacks, persistence and lateral movement (theregister.com).
  • Other fixes in the same release (docs.gitlab.com):
    • CVE-2026-15723 (CVSS 8.2, affects 10.1 onward): an authenticated user can take over an existing LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both enabled, with no victim interaction. gbhackers.com attributes the cause to improper input sanitization in the LDAP email lookup used for identity linking.
    • CVE-2026-112212 (CVSS 7.5, affects 18.3 onward): an unauthenticated user can poison the shared OAuth/OIDC discovery cache and redirect flows to an attacker-controlled server.
    • CVE-2026-12664 (CVSS 6.8): a GraphQL field leaks the project incoming email address, letting a read_api token create work items.
    • CVE-2026-16255 (CVSS 5.9, EE): incomplete enforcement of the SAML/LDAP membership lock.
    • CVE-2026-105777 (CVSS 4.3): internal credentials exposed through response headers.
    • CVE-2026-13319 (CVSS 4.3): private project milestone metadata readable through the group milestones API.
    • CVE-2026-112378 (CVSS 4.3, EE): paid AI features reachable without a valid subscription.
    • CVE-2026-105711 (CVSS 3.5): confidential issue titles leak through a fragment cache.
    • CVE-2026-14288 (CVSS 3.1, EE): merge request approval policy bypass.
    • CVE-2026-112326 (CVSS 3.1, EE): a read-only user can delete vulnerability records.
    • CVE-2026-103515 (CVSS 2.7, EE): a group Owner can bypass the Duo admin lock for Amazon Q settings.
  • Context: this is the third critical GitLab flaw in about a month, after CVE-2026-97229 and CVE-2026-85706 (unauthenticated data read, added to the CISA exploited list one day after its fix). CISA has flagged five GitLab flaws as exploited since November 2021, including one used in ransomware (bleepingcomputer.com).

Remediação

  • Upgrade self-managed CE/EE immediately to the fixed release for the installed branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. This applies even to instances already patched on October 12 (thehackernews.com).
  • GitLab offers no interim workaround (thehackernews.com).
  • Because GitLab bundles its own Ruby, installing the fixed GitLab version applies the Ruby fix (thehackernews.com).
  • For other Ruby applications, upgrade Ruby 4.0 to 4.0.9, 3.4 to 3.4.12 and 3.3 to 3.3.13. Release 4.0.8 lacks the CVE-2026-110264 fix. Ruby 3.2 and earlier (end of life April 1, 2026) will get no fix, so move to 3.4 or 4.0 (thehackernews.com).
  • If Ruby cannot be upgraded, stop compiling regular expressions from untrusted input. Regexp.timeout does not stop these bugs, and capping pattern length is unreliable because short patterns can trigger them (thehackernews.com).
  • Do not rely on CVE-based scanning alone for Ruby, since Ruby has not requested its own CVEs (thehackernews.com).
  • GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action.
  • Deploy the two GitLab detections and hunt for attempts.
  • Plan for downtime on single-node instances, because the release includes database migrations (19.3.6 and 19.4.3 per thehackernews.com; 19.4.3 also has post-deployment migrations per gbhackers.com). Multi-node setups can use zero-downtime procedures.
  • Vulnerability details become public 90 days after the fixing release (gbhackers.com).

Relatos divergentes

  • Total fixed vulnerabilities: thehackernews.com says 11 in total. docs.gitlab.com (the vendor, most authoritative) says eleven others besides CVE-2026-110264, and gbhackers.com says twelve in total. docs.gitlab.com lists 12 CVEs, which supports 12.
  • Researcher: thehackernews.com, gbhackers.com and bleepingcomputer.com name joaxcar. theregister.com names Johan Carlsson. The sources do not explicitly say these are the same person.
  • Version ranges: bleepingcomputer.com lists only fixed versions. docs.gitlab.com, thehackernews.com, gbhackers.com and theregister.com state that all versions from 7.0 onward are affected.
  • Prior exploitation: theregister.com says another max-severity CE/EE flaw was attacked days after its patch last month, per CISA and private researchers, without naming it. bleepingcomputer.com says CVE-2026-85706 was added to the CISA exploited list one day after its fix. No source reports exploitation of CVE-2026-110264 itself. The latest KEV check (thehackernews.com, October 23) found none of the four regex CVEs listed.
  • Framing of the series: bleepingcomputer.com calls this the third critical flaw in a month. thehackernews.com calls it the fourth regex-engine code-execution flaw from the same researcher in a month.
  • CVE-2026-15723 cause: docs.gitlab.com describes improper authentication. gbhackers.com cites improper input sanitization in the LDAP email lookup. The two are not necessarily incompatible.

Linha do tempo

  1. thehackernews.com ↗ · pub. 23/10/2026 14:54 · coletado 23/10 15:00

    Ruby patches three Onigmo regex engine bugs behind four critical GitLab RCE flaws (4.0.9, 3.4.12, 3.3.13)

    The article traces the four critical GitLab regex flaws to three upstream Onigmo bugs and reports Ruby releases 4.0.9, 3.4.12 and 3.3.13. It widens the scope to any Ruby application compiling attacker-controlled regexes, says 4.0.8 lacks the CVE-2026-110264 fix, and says Ruby 3.2 and earlier get no fix. It also says Ruby requested no CVEs of its own, which leaves a scanner gap, and that Regexp.timeout and length caps are not effective mitigations. None of the four CVEs was in CISA KEV as of October 23.

    ler a análise desta fonte

    The article traces the four critical GitLab regex flaws to three upstream Onigmo bugs and reports Ruby releases 4.0.9, 3.4.12 and 3.3.13. It widens the scope to any Ruby application compiling attacker-controlled regexes, says 4.0.8 lacks the CVE-2026-110264 fix, and says Ruby 3.2 and earlier get no fix. It also says Ruby requested no CVEs of its own, which leaves a scanner gap, and that Regexp.timeout and length caps are not effective mitigations. None of the four CVEs was in CISA KEV as of October 23.

    Ruby released versions 4.0.9, 3.4.12 and 3.3.13 to fix three memory-corruption bugs in Onigmo, the regular expression engine built into the language. The bugs underlie four critical GitLab flaws patched between September 23 and October 21, 2026, all reported by researcher joaxcar through GitLab's bug bounty program. Any Ruby application that compiles a regular expression from attacker-controlled text is affected, not only GitLab. Ruby 3.2 and earlier will receive no fix. As of October 23, none of the four GitLab CVEs was in CISA's KEV catalog.

    Technical Details

    • Affected pattern: an application passes an attacker-controlled string to Regexp.new, Regexp.union or Regexp.compile, or interpolates it into a pattern such as /#{input}/. Applications that use only developer-written patterns are not affected.
    • A crafted pattern can corrupt memory while Ruby compiles it, potentially leading to code execution.
    • GitLab compiles user-supplied patterns, such as those in CI/CD configuration. It issued four CVEs and fixed each by shipping a patched Ruby.
    • The two September 23 CVEs need a logged-in account and were rated 9.9. CVE-2026-97229 (October 12) and CVE-2026-110264 (October 21) need no account and were rated 10.0. CVE-2026-110264 reaches every GitLab version from 7.0 onward.
    • Ruby has not requested CVE IDs of its own "at least for now" and points users to GitLab's four CVEs. GitLab's CVE records name only GitLab as the affected product, so scanners that match CVEs against installed Ruby versions will find nothing.
    • Ruby's documentation still describes untrusted patterns only as a denial-of-service risk, although it assigned CVEs to similar fixes in 2022 and 2024.

    Remediation

    • Upgrade Ruby 4.0 to 4.0.9, 3.4 to 3.4.12 and 3.3 to 3.3.13. Release 4.0.8 lacks the fix for CVE-2026-110264.
    • Ruby 3.2 reached end of life on April 1, 2026 (final release 3.2.11). Move to 3.4 or 4.0.
    • If you cannot upgrade, stop compiling regular expressions from untrusted input. Regexp.timeout does not stop these bugs, and capping pattern length is unreliable because short patterns can trigger them.
    • Self-managed GitLab needs the October 21 release, backported as far as 18.11.13. GitLab bundles its own Ruby, so installing the fixed GitLab version applies the fix. GitLab.com is already patched, and GitLab Dedicated tenants on recent internal releases need no action.
    • GitLab published detection rules for self-managed administrators to look for exploitation attempts.
  2. theregister.com ↗ · pub. 22/10/2026 14:36 · coletado 22/10 15:00

    GitLab patches max-severity unauthenticated RCE (CVE-2026-110264) affecting CE/EE releases back to 7.0

    The Register adds that affected versions go back to GitLab 7.0 (June 2014), that the researcher is named as Johan Carlsson, and that GitLab released two threat detections for self-managed customers. It also cites SOC Prime's impact assessment and states there is no indication of in-the-wild exploitation yet.

    ler a análise desta fonte

    The Register adds that affected versions go back to GitLab 7.0 (June 2014), that the researcher is named as Johan Carlsson, and that GitLab released two threat detections for self-managed customers. It also cites SOC Prime's impact assessment and states there is no indication of in-the-wild exploitation yet.

    GitLab patched CVE-2026-110264, a CVSS 10 integer overflow in regular-expression compilation that, under certain conditions, lets unauthenticated attackers execute arbitrary code on self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) servers. Affected releases reach back 12 years to GitLab 7.0 (June 2014). The vendor "strongly recommends" upgrading as soon as possible. No in-the-wild exploitation has been reported yet, but the report expects scanning for vulnerable instances to start soon. The bug was reported by Johan Carlsson via HackerOne.

    Technical Details

    • Integer overflow when compiling a specially crafted regular expression; exploitation requires no authentication, under certain conditions.
    • Affects GitLab CE and EE from 7.0 onward.
    • SOC Prime warns that server compromise could expose source code, CI/CD configuration, deployment secrets, access tokens and infrastructure definitions. This enables credential theft, repository manipulation, supply chain attacks, persistence and lateral movement.
    • Last month another max-severity flaw in GitLab CE/EE was attacked days after its patch, according to CISA and private researchers.

    Remediation

    • Upgrade to 19.5.1, 19.4.3 or 19.3.6, or to the backported releases 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
    • GitLab.com and GitLab Dedicated are already patched.
    • GitLab released two threat detections for customers with self-managed instances.
  3. bleepingcomputer.com ↗ · pub. 22/10/2026 08:41 · coletado 22/10 09:00

    GitLab patches max-severity unauthenticated RCE (CVE-2026-110264) in Regular Expression Compiler

    ler a análise desta fonte

    GitLab released security patches for CVE-2026-110264, a maximum-severity integer overflow flaw in its Regular Expression Compiler that can let an unauthenticated remote attacker execute arbitrary code on vulnerable servers. The researcher joaxcar reported it through GitLab's HackerOne bug bounty program. Shadowserver currently tracks over 2,700 internet-exposed GitLab Community Edition instances, though it does not say how many are honeypots or already patched. The article does not report exploitation in the wild. This is the third critical GitLab flaw in about a month, following CVE-2026-97229 (CI/CD Regular Expression Compiler RCE, CVSS 10/10, reported by the same researcher ten days earlier) and CVE-2026-85706 (unauthenticated data read, added to CISA's actively exploited list one day after its fix).

    Technical Details

    • The flaw is an integer overflow triggered when compiling a specially crafted regular expression, which can allow unauthenticated code execution on the GitLab server.
    • The Regular Expression Compiler is a background engine that parses and validates regular expressions in configuration files.
    • Affected products are GitLab CE and EE. The article does not list the vulnerable version ranges, only the fixed versions.
    • Since November 2021, CISA has flagged five GitLab flaws exploited in the wild, including one used in ransomware attacks.

    Remediation

    • Upgrade GitLab CE/EE to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13 immediately.
    • GitLab.com already runs the patched version.
    • GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes and need no action.
  4. gbhackers.com ↗ · pub. 22/10/2026 01:53 · coletado 22/10 02:00

    GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in CE/EE affecting versions since 7.0

    The article largely restates the known report, with a few added details: 19.4.3 also carries post-deployment migrations, CVE-2026-15723 stems from improper input sanitization in the LDAP email lookup, and the RCE fix is backported to four older branches. It also notes that the advisory's detection guidance should not be read as confirmation of exploitation.

    ler a análise desta fonte

    The article largely restates the known report, with a few added details: 19.4.3 also carries post-deployment migrations, CVE-2026-15723 stems from improper input sanitization in the LDAP email lookup, and the RCE fix is backported to four older branches. It also notes that the advisory's detection guidance should not be read as confirmation of exploitation.

    GitLab released emergency security updates on October 21, 2026 for CVE-2026-110264, a CVSS 10.0 remote code execution flaw in GitLab Community Edition and Enterprise Edition that unauthenticated attackers could use to run arbitrary code on the server. The bug is an integer overflow in the regular expression compiler triggered by a specially crafted expression. Affected releases go back to version 7.0, and fixes ship in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. Researcher joaxcar reported it through HackerOne. GitLab's advisory does not indicate in-the-wild exploitation. The release fixes twelve vulnerabilities in total, including two high-severity ones.

    Technical Details

    • CVE-2026-110264: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The RCE fix is backported to four older branches beyond the standard patch releases.
    • GitLab published two detections for self-managed customers, "Onigmo native worker crash" and "Org mode render error burst". They support investigation of exploitation attempts and are not confirmation of an active campaign.
    • CVE-2026-15723 (CVSS 8.2): an authenticated attacker can take over an existing LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both enabled. The cause is improper input sanitization in the LDAP email lookup used for identity linking, and the victim does not need to interact.
    • CVE-2026-112212 (CVSS 7.5): cache poisoning in OAuth/OIDC discovery endpoints lets an unauthenticated attacker alter a shared discovery document and redirect flows to an attacker-controlled server.
    • Other fixes cover GraphQL token restrictions, identity-provider membership locks, internal credential exposure, private milestone metadata disclosure, AI subscription checks, confidential issue titles, approval policies, vulnerability records and administrative AI controls.
    • Versions 19.3.6 and 19.4.3 include regular database migrations, and 19.4.3 also includes post-deployment migrations.

    Remediation

    • Upgrade self-managed instances immediately to the fixed release for the installed branch.
    • GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action.
    • Single-node upgrades require downtime for migrations. Multi-node environments can avoid it with zero-downtime procedures.
    • Vulnerability details become public 90 days after the fixing release.
  5. thehackernews.com ↗ · pub. 21/10/2026 15:57 · coletado 21/10 17:00

    GitLab fixes CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in the regex compiler affecting every release since 7.0

    The article adds that the October 12 patch (CVE-2026-97229) covered only 19.2 and later, so instances patched then must upgrade again. It also adds the Onigmo root cause, the link to the three earlier regex flaws reported by joaxcar, GitLab's statement that it sees no exploitation, the absence from CISA KEV as of October 22, and the lack of any workaround or stated attack preconditions.

    ler a análise desta fonte

    The article adds that the October 12 patch (CVE-2026-97229) covered only 19.2 and later, so instances patched then must upgrade again. It also adds the Onigmo root cause, the link to the three earlier regex flaws reported by joaxcar, GitLab's statement that it sees no exploitation, the absence from CISA KEV as of October 22, and the lack of any workaround or stated attack preconditions.

    GitLab released fixes on October 21 for CVE-2026-110264, a CVSS 10.0 flaw that could let an unauthenticated attacker run arbitrary code on a self-managed server. It affects every version back to 7.0 (2014). The flaw is an integer overflow in the compilation of a specially crafted regular expression, in the Onigmo engine that GitLab bundles. Administrators who patched on October 12 are in range again, because that update covered only versions 19.2 and later. GitLab reports no sign of exploitation, and the flaw was not in the CISA KEV catalog as of October 22.

    Technical Details

    • Root cause: an integer overflow in Onigmo, Ruby's built-in regex engine, which GitLab ships and patches in its own packages. Every release since 7.0 is affected.
    • GitLab has not said what conditions or preconditions an attacker needs to reach the compiler, so administrators cannot rule themselves out by configuration.
    • It is the fourth regex-engine code-execution flaw reported by researcher joaxcar in a month, and the first to reach versions before 19.2. The earlier ones are CVE-2026-97229 (CVSS 10.0, unauthenticated, fixed October 12 in 19.2.8, 19.3.5 and 19.4.2) and CVE-2026-93577 and CVE-2026-89078 (both CVSS 9.9, authenticated, fixed September 23).
    • The fix was backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9, beyond the normal policy of the current and previous two releases.
    • The release fixes 11 security issues in total, including CVE-2026-15723 (CVSS 8.2, account takeover with SAML and LDAP auto-linking) and CVE-2026-112212 (CVSS 7.5, OAuth/OIDC cache poisoning).
    • GitLab published two Sigma detections in its TLDR framework, "Onigmo native worker crash" and "Org mode render error burst".

    Remediation

    • Upgrade self-managed instances to the fixed version for the installed branch, even if already patched on October 12. GitLab.com and GitLab Dedicated 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix.
    • GitLab offers no interim workaround.
    • Deploy the two detection rules to look for exploitation attempts.
    • Plan for downtime on single-node servers, because 19.4.3 and 19.3.6 run database migrations. Multi-node setups can use the zero-downtime procedure.
  6. docs.gitlab.com ↗ · pub. 20/10/2026 21:00 · coletado 21/10 16:01 primeiro registro

    GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in CE/EE, in critical patch release 19.5.1

    ler a análise desta fonte

    GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for GitLab CE/EE on October 21, 2026. The release fixes CVE-2026-110264, an integer overflow in the regular expression compiler that could allow an unauthenticated user to execute arbitrary code on the GitLab server (CVSS 10.0). It affects all versions from 7.0 onward before the fixed releases. Eleven other vulnerabilities are fixed, including an account takeover via OmniAuth SAML and LDAP auto-linking (CVE-2026-15723, CVSS 8.2) and OAuth/OIDC discovery cache poisoning (CVE-2026-112212, CVSS 7.5). The article does not report in-the-wild exploitation. GitLab urges all self-managed installations to upgrade immediately. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action.

    Technical Details

    • CVE-2026-110264 (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C): integer overflow when compiling a specially crafted regular expression, leading to RCE. The fix is backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9. The release also adds Ruby regexp repeat ID overflow and double-free patches for Ruby 3.3, 3.4 and 4.0. GitLab published two detections for self-managed instances: "Onigmo native worker crash" and "Org mode render error burst".
    • CVE-2026-15723 (CVSS 8.2): improper authentication. When OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated user can take over an existing LDAP-backed account with no interaction from the victim. Affects 10.1 onward.
    • CVE-2026-112212 (CVSS 7.5): an unauthenticated user can poison a shared cache of the OAuth/OIDC discovery document and redirect flows to an attacker-controlled server. Affects 18.3 onward.
    • CVE-2026-12664 (CVSS 6.8): a GraphQL field leaks the project incoming email address, allowing a read_api token to create work items. Affects 18.2 onward.
    • CVE-2026-16255 (CVSS 5.9, EE): the SAML/LDAP membership lock is incompletely enforced for requests created before the lock was enabled.
    • CVE-2026-105777 (CVSS 4.3): internal server credentials exposed through internal response headers.
    • CVE-2026-13319 (CVSS 4.3): the group milestones API lets a user read milestone metadata from arbitrary private projects.
    • CVE-2026-112378 (CVSS 4.3, EE): paid AI features can be accessed without a valid subscription.
    • CVE-2026-105711 (CVSS 3.5): a fragment cache leaks the titles of confidential issues.
    • CVE-2026-14288 (CVSS 3.1, EE): merge request approval policy bypass.
    • CVE-2026-112326 (CVSS 3.1, EE): a read-only user can delete vulnerability records.
    • CVE-2026-103515 (CVSS 2.7, EE): a group Owner can bypass the Duo admin lock for Amazon Q settings.
    • The patch includes database migrations. Single-node instances will have downtime, while multi-node instances can upgrade without downtime using zero-downtime procedures.

    Remediation

    • Upgrade all self-managed GitLab instances immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, whichever matches the installed branch.
    • Deploy the two GitLab threat detections for CVE-2026-110264 on self-managed instances.
    • Plan for downtime on single-node instances because of the migrations.
    • Issue details are made public on the GitLab tracker 90 days after the patch release.