What Happened
The Hacker News reports GitLab patched CVE-2026-110264 on October 21. The flaw scores CVSS 10.0. It is an integer overflow in Onigmo, the regex engine GitLab ships in its packages. Under conditions GitLab has not disclosed, an unauthenticated user runs arbitrary code on a self-managed server.
Every release back to version 7.0 is affected. Fixed versions include 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated already carry the fix. GitLab reports no exploitation, and the flaw is not in the CISA KEV catalog. The researcher joaxcar has now reported four regex-engine code execution flaws in a month. The earlier CVE-2026-97229 also scored 10.0 and was fixed on October 12.
Why This Matters for Canadian Organizations
Self-managed GitLab is common in Canadian government departments, banks, universities, and health systems. Teams choose it to keep source code and pipelines on Canadian soil. The same choice means the patch burden falls on you, and no vendor applies it for you.
A GitLab server holds source code, deploy keys, and CI secrets. An attacker with code execution there reaches every system the pipelines touch. For federally regulated institutions, this is a third-party and change-management risk under OSFI Guideline B-13. A confirmed read of personal information starts a PIPEDA breach assessment.
What to Do
Upgrade to a fixed release now. GitLab offers no workaround, so patching is the only certain protection. Plan for downtime on single-node servers, because versions 19.4.3 and 19.3.6 include database changes. Multi-node setups follow GitLab’s zero-downtime procedure.
Check old instances first. Releases back to 7.0 are affected, and forgotten test servers are easy to miss. Restrict internet exposure through a VPN or allowlist. Deploy GitLab’s two detection rules, “Onigmo native worker crash” and “Org mode render error burst,” and rotate CI secrets if you see either signal. Read more in our TechTalk archive.
