Loading vulnerability…
CVE-2026-110264 is a critical integer-overflow vulnerability in the Onigmo regular-expression engine used by Ruby in GitLab Community Edition and Enterprise Edition. Compiling a specially crafted regular expression can overflow internal identifier values, leading to out-of-bounds memory access and potentially arbitrary code execution on the GitLab server. Exploitation requires neither authentication nor user interaction, although the complete application-level attack path and triggering conditions have not been disclosed. Affected versions are 7.0 through versions before 18.11.13; 19.0 before 19.0.10; 19.1 before 19.1.9; 19.2 before 19.2.9; 19.3 before 19.3.6; 19.4 before 19.4.3; and 19.5 before 19.5.1. The vulnerability has a CVSS v3.1 score of 10.0. No confirmed exploitation or public proof of concept was identified as of October 22, 2026.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
111 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical vulnerability in GitLab Community Edition and Enterprise Edition, rated CVSS 10.0, allows an unauthenticated attacker to execute arbitrary code. The advisory identifies versions starting with 7.0 as affected and lists fixes in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. CERT-SE recommends promptly upgrading according to the vendor's instructions and checking for anomalous product behavior.
The advisory describes a critical integer overflow during compilation of a specially crafted regular expression in GitLab CE/EE, allowing an unauthenticated remote attacker to execute arbitrary code on the server. It reports a CVSS score of 10.0 and states that the vulnerability has existed since version 7.0, released in 2014. Fixed releases are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. Immediate updating of self-managed instances is recommended. The advisory links to guidance for investigating Onigmo worker crashes and exception logs for exploitation attempts, but does not report confirmed exploitation.
A CVSS 10.0 unauthenticated remote code execution vulnerability affecting self-managed GitLab Community Edition and Enterprise Edition. The flaw involves an integer overflow during regular-expression compilation, with Onigmo identified as the underlying affected engine. Affected releases date back to GitLab 7.0. GitLab disclosed the issue and released fixes on October 21, 2026: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. Successful exploitation could expose source code and secrets and enable repository tampering or downstream supply-chain compromise. As of October 22, the content reports no confirmed real-world exploitation and no publicly disclosed proof of concept; the complete attack path remains withheld. Immediate upgrading is recommended, with no equivalent alternative workaround published.
An unauthenticated remote code execution vulnerability in GitLab that could allow an attacker to execute malicious programs and potentially take control of the server. The advisory broadly identifies affected GitLab versions from 7.0 through certain 19.x releases without providing precise affected ranges for this individual vulnerability. Patched releases are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. Detection rules are available, but no active exploitation has been observed.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.