GitLab: Unauthenticated RCE via Ruby Onigmo regex compiler integer overflow across all releases since 7.0 (CVE-2026-110264)
Severity: critical · Patch status: patched · Since 2026-10-21 · CVE-2026-100104, CVE-2026-100755, CVE-2026-101168, CVE-2026-103515, CVE-2026-103549, CVE-2026-104661, CVE-2026-105458, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14210, CVE-2026-14288, CVE-2026-14552, CVE-2026-14814, CVE-2026-15723, CVE-2026-16255, CVE-2026-16275, CVE-2026-16301, CVE-2026-5954, CVE-2026-6567, CVE-2026-7767, CVE-2026-78335, CVE-2026-81839, CVE-2026-82632, CVE-2026-84284, CVE-2026-85529, CVE-2026-89078, CVE-2026-92528, CVE-2026-9268, CVE-2026-92883, CVE-2026-93577, CVE-2026-96893, CVE-2026-97229
GitLab patched CVE-2026-110264 (CVSS 10.0), an unauthenticated RCE caused by an integer overflow in Ruby's Onigmo regex compiler, which GitLab bundles and ships. It affects every self-managed GitLab version since 7.0 (2014); the Oct 12 fix for the earlier CVE-2026-97229 covered only 19.2+, so instances patched then are vulnerable again. It is the fourth Onigmo RCE reported by researcher joaxcar in a month (two 9.9 auth-required, two 10.0 unauthenticated). Ruby released 4.0.9, 3.4.12, and 3.3.13 fixing three underlying bugs; Ruby 3.2 and earlier get no fix. No exploitation or CISA KEV listing as of Oct 23; no workaround exists. GitLab also fixed 10 other issues including an 8.2 account-takeover and a 7.5 OAuth/OIDC cache-poisoning flaw.
What to do
- Upgrade self-managed GitLab immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 — instances patched on Oct 12 are still vulnerable
- Plan for downtime on single-node upgrades (19.4.3/19.3.6 include database migrations); use zero-downtime procedure on multi-node
- Deploy GitLab's TLDR Sigma detection rules ('Onigmo native worker crash', 'Org mode render error burst') to hunt exploitation attempts
- Upgrade Ruby to 4.0.9, 3.4.12, or 3.3.13 in any Ruby app compiling regexes from untrusted input; note Regexp.timeout and pattern-length caps do not mitigate
- Migrate off Ruby 3.2 (EOL, unfixed) or stop compiling attacker-controlled patterns via Regexp.new/union/compile or interpolation
- Review SAML+LDAP auto-linking and shared-cache OAuth/OIDC setups against CVE-2026-15723 and CVE-2026-112212
Fixed versions
- GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
- Ruby 4.0.9, 3.4.12, 3.3.13
Sources
All live incidents on Threat Watch
