GitLab Patches Maximum-Severity CVSS 10.0 Unauthenticated RCE Flaw Spanning 12 Years of Releases

GitLab has issued emergency security releases addressing a catastrophic unauthenticated Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-110264 and evaluated at the maximum possible CVSS score of 10.0. The vulnerability allows an unauthenticated remote adversary to achieve arbitrary machine code execution on self-managed GitLab servers by submitting specially crafted input that triggers an integer overflow during regular expression compilation.

The flaw is notable not only for its total lack of authentication requirements and maximum severity rating, but for its unprecedented historical reach: the vulnerability impacts every version of GitLab Community Edition (CE) and Enterprise Edition (EE) released across the past 12 years, tracing back to GitLab version 7.0 launched in 2014. In response, GitLab took the extraordinary measure of backporting security hotfixes across seven release streams simultaneously—far beyond its customary three-version support window.

Attack Mechanics & Root Cause: The Onigmo Regex Engine Breakdown

The architectural root cause of CVE-2026-110264 resides not in GitLab's Ruby on Rails application controllers, but in the underlying regular expression compilation engine bundled inside the Ruby runtime environment distributed with GitLab Omnibus and cloud native container packages: Onigmo (Oniguruma-mod).

When GitLab processes user-supplied markdown, wiki entries, repository files, commit messages, or Org-mode markup, text parsing passes string patterns into the C-based regex engine for token evaluation and pattern matching. During the compilation phase of a maliciously constructed nested regular expression pattern containing quantifier repetitions, Onigmo performs arithmetic operations to allocate bytecode structures representing parse trees and node states.

Due to insufficient integer bounds validation prior to buffer sizing in the parser's allocation routines (CWE-190), integer wraparound occurs. A large calculated size wraps around to a small integer value, causing the memory allocator to assign a diminutive heap buffer. Subsequent AST compilation loops write unvalidated bytecode past the boundary of the allocated buffer, producing an out-of-bounds heap memory overwrite.

# Conceptual abstraction of Onigmo integer allocation wraparound
# Size calculation: (num_nodes * sizeof(NodeState)) + state_overhead
# When num_nodes exceeds 0x3FFFFFFF, multiplication overflows 32-bit uint:
size_t alloc_sz = (size_t)(nodes * sizeof(AstNode)); // Overflows to 0x00000040
void *buf = malloc(alloc_sz);                       // Allocates undersized heap block
compile_nodes(ast_root, buf);                       // Heap buffer overflow occurs

Because the overflow occurs inside the Puma web worker or Sidekiq background job processor context, the attacker hijacks control-flow registers (such as instruction pointers or function pointer tables), executing shellcode with the privileges of the git system user. From this execution boundary, an adversary can manipulate repositories, extract CI/CD environment variables and secrets (including AWS, GCP, and Kubernetes credentials), and pivot deeper into enterprise internal networks.

Consecutive Regex Compiler Exploits: A Four-Week Vulnerability Cluster

CVE-2026-110264 represents the fourth severe regular expression engine code execution vulnerability resolved by GitLab within a four-week period, all identified through coordinated vulnerability research by security researcher joaxcar. However, unlike previous disclosures, CVE-2026-110264 requires zero prior authentication and extends across a dozen years of legacy code:

Crucially, enterprise instances that applied the emergency security patch on October 12, 2026, remain vulnerable to CVE-2026-110264. The October 21 patches sit one version higher on all release branches, making immediate re-patching mandatory.

Secondary Vulnerabilities in the October 21 Security Bundle

Alongside the critical Onigmo integer overflow, GitLab's October 21 security release resolved 10 additional security defects, including two high-severity authentication bypass and session hijacking vectors:

• CVE-2026-15723 (CVSS 8.2 — High): Account Takeover via Improper SAML/LDAP Auto-Linking. Under configurations where administrators enabled both SAML and LDAP auto-linking, an attacker with basic account access could force account association with high-privileged administrator profiles, bypassing multi-factor authentication controls.
• CVE-2026-112212 (CVSS 7.5 — High): Cache Poisoning in OAuth and OpenID Connect (OIDC) Endpoints. Environments utilizing shared reverse proxies or web application caches could suffer response cache poisoning, redirecting user OAuth tokens and authorization codes to adversary-controlled endpoints.

Defensive Playbook & Remediation Engineering

Because no configuration workaround or feature flag can neutralize the underlying Onigmo compiler overflow without disabling essential text rendering engines, self-managed administrators must upgrade instances immediately.

1. Upgrade Path Matrix

Identify the currently running GitLab release branch and apply the designated upgrade target:

2. Package Upgrade Commands

Execute package updates according to deployment type:

# For Debian / Ubuntu Omnibus installations:
sudo apt-get update
sudo apt-get install --only-upgrade gitlab-ee=19.5.1-ee.0 -y
# Or for Community Edition:
sudo apt-get install --only-upgrade gitlab-ce=19.5.1-ce.0 -y

# For Red Hat / Rocky Linux Omnibus:
sudo dnf check-update
sudo dnf upgrade gitlab-ee-19.5.1-ee.0 -y

# For Docker deployments:
docker pull gitlab/gitlab-ee:19.5.1-ee.0
docker-compose down && docker-compose up -d

# For Helm Chart / Kubernetes:
helm repo update
helm upgrade gitlab gitlab/gitlab --version 8.5.1 \
  --set global.hosts.domain=gitlab.enterprise.internal

Threat Hunting, SIEM Log Auditing & Sigma Rules

GitLab's Threat Detection and Response (TLDR) team published two dedicated detection signatures formatted for enterprise SIEM ingestion to hunt for active exploitation attempts across production_json.log, puma.stderr.log, and sidekiq.log:

Sigma Rule 1: Onigmo Native Web Worker Crash

title: GitLab Onigmo Native Worker Segmentation Fault
id: 4b9e28f1-8d2a-41f2-9c1a-82f5b8d9e012
status: experimental
description: Detects Puma web workers terminating via SIGSEGV caused by Onigmo regex heap overflows
logsource:
  product: gitlab
  service: puma
detection:
  selection:
    log.level: "fatal"
    message|contains:
      - "[SIGSEGV]"
      - "terminated due to unhandled signal 11"
      - "onigmo"
  condition: selection
level: critical

Sigma Rule 2: Org-Mode Parser Anomaly Spike

title: GitLab Org-Mode Render Error Burst
id: 7c8a14b3-3e11-4fa2-bf44-1189acdf0981
status: experimental
description: Identifies anomalous spikes in Org-mode text rendering exceptions preceding process failure
logsource:
  product: gitlab
  service: production_json
detection:
  selection:
    controller: "Projects::BlobController"
    action: "show"
    status: 500
    exception.class: "Orgmode::ParserError"
  condition: selection | count() by ip_address > 10
timeframe: 5m
level: high

Host-Level Forensic Verification

Security analysts should query running hosts for unexpected subprocess spawning originating from the git user context:

# Audit child processes spawned by Puma or Sidekiq
pstree -p $(pgrep -f "puma.*gitlab") | grep -iE "(sh|bash|python|perl|curl|wget|nc)"

# Audit outbound network sockets established by the git user
ss -tupn | grep $(id -u git)

# Inspect Puma error logs for regex engine memory faults
grep -iE "(onigmo|segmentation fault|SIGSEGV|alloc_sz)" /var/log/gitlab/puma/puma.stderr.log