Loading story…
GitLab released emergency security updates for CVE-2026-110264, a CVSS 10.0 vulnerability that could allow unauthenticated remote code execution on self-managed Community Edition and Enterprise Edition installations under undisclosed conditions. The flaw involves an integer overflow when compiling a specially crafted regular expression in Ruby’s Onigmo engine and affects releases dating back to version 7.0. Fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, extending patches to four branches outside normal maintenance. The release addresses 12 vulnerabilities, including high-severity issues involving LDAP-backed account takeover and OAuth/OIDC discovery cache poisoning.
Self-managed administrators should upgrade immediately, including those who installed the October 12 security updates; GitLab offers no interim workaround. GitLab.com and qualifying GitLab Dedicated deployments are already patched. GitLab reports no observed exploitation and has published two detection rules for potential exploitation attempts; single-node operators should plan for possible upgrade downtime. An earlier third-party report described a similar regex-related RCE under a different identifier, CVE-2026-97229, and cited fixes in versions 19.2.8, 19.3.4, and 19.4.2. Those technical claims remain unverified and should not be conflated with the current advisory or treated as evidence that those earlier versions remediate CVE-2026-110264.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-85706 to its actively exploited vulnerabilities list one day after GitLab released a fix and directed federal agencies to remediate it within three days. The maximum-severity flaw allows unauthenticated attackers to read sensitive data, including credentials and other secrets.
GitLab released the rules "Onigmo native worker crash" and "Org mode render error burst" to help self-managed administrators investigate potential exploitation attempts. The rules use Sigma format against GitLab application logs; GitLab reported no indication of exploitation.
GitLab reported that GitLab.com already contained the fixes and that GitLab Dedicated tenants running 19.3.5-internal0 or 19.4.2-internal0 or later required no action. The sources do not specify when these hosted deployments were patched.
GitLab published a CVE record describing a high-severity flaw allowing unauthenticated attackers, under certain conditions, to poison cached OAuth/OIDC discovery responses and redirect flows to an attacker-controlled server. The vulnerability affects Community and Enterprise editions and was fixed in versions 19.3.6, 19.4.3, and 19.5.1.
GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, fixing CVE-2026-110264 and other security issues, with the official advisory listing 12 vulnerabilities in total. The critical flaw involves an integer overflow in Onigmo regular-expression compilation and could permit unauthenticated code execution; GitLab backported its fix to four branches outside the normal maintenance window.
GitLab merged a backport adding regular-expression repeat-ID overflow checks for Ruby 3.3, 3.4, and 4.0 into 19-3-stable as commit a4cf5b99. The merge request carried a severity1 label but did not identify a CVE or establish exploitation or security impact.
GitLab released fixes for CVE-2026-97229, a CVSS 10.0 regular-expression compiler overflow that could allow unauthenticated remote code execution. The fixes did not protect installations against the subsequently disclosed CVE-2026-110264.
GitLab fixed CVE-2026-93577 and CVE-2026-89078, both rated CVSS 9.9 and requiring an authenticated account. Both vulnerabilities affected releases starting at version 19.2.
GitLab released version 7.0 in 2014. It is the earliest release identified as affected by the subsequently disclosed critical regular-expression compilation vulnerability CVE-2026-110264.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
30 references tracked. Mallory keeps watching after this page renders.
cert.se
Open sourcecsirt.sk
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecyberveille.ch
Open sourcegitlab.com
Open sourcecve.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released Community Edition and Enterprise Edition versions **19.2.8, 19.3.4, and 19.4.2** to address 24 security issues, including **CVE-2026-97229**, a critical vulnerability rated CVSS 10.0. The flaw could allow an unauthenticated attacker to execute arbitrary code through a specially crafted regular expression in CI/CD configuration. Reports describe an integer overflow and insufficient validation in the regular expression compiler, but GitLab has not disclosed a complete attack sequence or exact exploitation conditions. The release notice does not report real-world exploitation. The updates also fix five high-severity vulnerabilities and weaknesses involving cross-site scripting, unauthorized pipeline execution, cache poisoning, AI prompt injection, sensitive-data exposure, and authorization bypasses. GitLab recommends **immediately upgrading affected self-managed installations**, with internet-facing deployments a priority; GitLab.com is already patched, and GitLab Dedicated customers need no action. Administrators should account for database migrations that cause downtime during single-node upgrades, while properly executed multi-node upgrades can avoid downtime. After patching, security teams should review logs and CI/CD configuration changes for suspicious activity and investigate connected systems if compromise is suspected. Two release caveats warrant attention: version 19.3.4 has a known merge request page bug when the Ona integration is enabled, and the advisory inconsistently lists all 19.3 versions as affected by CVE-2026-84284 despite naming 19.3.4 as a security patch release; administrators should seek clarification on that separate flaw's remediation status.
Oct 16, 2026
GitLab released versions **19.3.2**, **19.2.6**, and **19.1.8** for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The most severe, **CVE-2026-85706** (CVSS 10.0), is an unauthenticated path-traversal flaw in the repository commits API that enables arbitrary file reads from vulnerable GitLab servers. GitLab also addressed authorization issues, cross-site scripting, CI/CD-variable exposure, and denial-of-service vulnerabilities. Enterprise Edition fixes include **CVE-2026-87719** (CVSS 9.9), an authenticated insecure-deserialization issue associated with Duo Chat/GraphQL subscription handling that can expose Advanced Search configuration and credentials, and **CVE-2026-88765** (CVSS 8.5), which can allow authenticated remote code execution through importing a crafted malicious Git project export. GitLab.com already runs the patched release and GitLab Dedicated customers need take no action; self-managed administrators should upgrade immediately and plan for database migrations, which require downtime on single-node deployments.
Sep 17, 2026
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 13, 2026