12-Year-Old GitLab Vulnerability Allows Remote Code Execution on Self-Managed Server

GitLab has released urgent security updates for a critical vulnerability that could let attackers run code on self-managed servers without logging in. Tracked as CVE-2026-110264, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the fixes on October 21, 2026.

The affected code reaches back to GitLab 7.0, released in 2014, giving the vulnerability a roughly 12-year history. That does not mean attackers have been using it for 12 years. GitLab’s advisory describes the risk but does not report confirmed attacks or provide a public exploit.

GitLab Remote Code Execution Flaw

According to GitLab’s official security advisory, the vulnerability involves an integer overflow when the server compiles a specially crafted regular expression. Regular expressions are patterns used to match text. Under certain conditions, processing an attacker-controlled pattern could allow arbitrary code to run on the server.

GitLab’s CVSS assessment describes a network-based attack with low complexity, no account privileges, and no required user interaction. It rates the possible impact on data privacy, data integrity, and service availability as high. However, the company has not disclosed the full conditions needed to reach the vulnerable code.

GitLab credited security researcher joaxcar with reporting the issue through its HackerOne bug bounty program. Its release notes also list Ruby regular-expression patches, providing further context about the affected software layer without revealing a complete attack path. Administrators should not assume the flaw requires access to a particular project or feature unless GitLab confirms that restriction.

Affected Versions and Available Fixes

The vulnerability affects GitLab CE and EE versions starting with 7.0. GitLab has fixed it in versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. Earlier releases within those branches remain affected. The company extended the fix to four older branches beyond its standard patch releases.

Self-managed customers should upgrade immediately. GitLab.com already runs patched software. GitLab Dedicated tenants running 19.3.5-internal0, 19.4.2-internal0, or later already include the fixes and require no action, according to the notice. GitLab also says that when an advisory does not name a specific deployment type, all deployment types are affected.

This issue should not be confused with the earlier GitLab code execution vulnerability patched on October 12. That separate flaw, CVE-2026-97229, also involved regular-expression handling but affected a different version range. Installing that earlier update does not address this newly disclosed vulnerability.

GitLab has published two detection guides for self-managed environments, named “Onigmo native worker crash” and “Org mode render error burst.” These resources are intended to help security teams identify possible exploitation attempts. Their publication is not evidence that attacks have occurred, and the release notice does not establish either signal as proof of a successful compromise.

The patch release addresses 12 vulnerabilities overall. Another serious issue, CVE-2026-15723, carries a CVSS score of 8.2. When OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated attacker could take over an existing LDAP-backed account without the victim’s involvement. CVE-2026-112212, rated 7.5, concerns poisoned OAuth and OpenID Connect discovery responses that could redirect certain flows to an attacker-controlled server.

These fixes follow other recent GitLab security updates, including a separate AI Gateway remote command execution vulnerability. Those reports concern different components and attack requirements, making accurate version checks more useful than assuming one GitLab update covers every related product.

Administrators should review GitLab’s upgrade instructions before deployment. The notice warns that database migrations can affect the process, with downtime for single-node installations and zero-downtime procedures available for suitable multi-node setups.

Versions 19.3.6 and 19.4.3 include regular migrations. GitLab normally makes detailed security issues public 90 days after patching, so teams should not delay updates while waiting for full technical details.

The GitLab fixes arrive alongside security updates for Node.js and PHP, adding to the patching workload for teams running web applications and development services.

Cyber Security News reports that Node.js released security updates addressing ten vulnerabilities across its 26.x, 24.x, and 22.x branches, with patched versions listed as 26.12.1, 24.22.1, and 22.23.4.

Meanwhile, PHP issued emergency patches for PHP2Shell, a pair of critical memory-handling flaws tracked as CVE-2026-109618 and CVE-2026-109619.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.