Ten days after CVE-2026-97229, GitLab is back with another CVSS 10.0 in the same corner of the product. CVE-2026-110264 is an integer overflow in GitLab’s Regular Expression Compiler, and GitLab’s own wording is blunt: under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server by getting it to compile a specially crafted regular expression (GitLab).
The blast radius is the story. The last one hit 19.2 through 19.4. This one covers GitLab CE/EE from 7.0 onward, which is roughly twelve years of releases. Fixed builds are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab backported the fix to 18.11, 19.0, 19.1 and 19.2 on top of its normal patch lines (GitLab). Anything older than 18.11 has no patched build in this release, so an old internal forge means a major upgrade, not a point patch.
GitLab scored it CVSS 3.1 10.0: network, low complexity, no privileges, no user interaction, scope changed. GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later already have the fix (GitLab). Self-managed is where the work is. Shadowserver tracks more than 2,700 GitLab CE instances exposed online, though it can’t say how many are honeypots or already patched (BleepingComputer).
What changed since Oct 12. Same researcher (joaxcar, via GitLab’s HackerOne program), same Onigmo-backed regex compiler family, but the earlier bug lived in the CI/CD compiler and, per Rapid7’s reproduction, needed a planted .gitlab-ci.yml in a public project. GitLab’s advisory for this one says unauthenticated and doesn’t name a CI prerequisite. Until a public technical write-up says otherwise, treat it as reachable from the internet with no account.
Exploitation status. GitLab hasn’t reported in-the-wild use, and as of this morning CVE-2026-110264 isn’t in CISA’s KEV catalog. History is the reason not to wait: CVE-2026-85706, last month’s max-severity GitLab bug, landed in KEV the day after GitLab disclosed it, and CISA has flagged five GitLab flaws as exploited since November 2021, one of them in ransomware attacks (BleepingComputer).
What we’d do this morning. Pull the exact version of every self-managed GitLab, including the forgotten ones in lab and acquisition networks. Upgrade to the fixed build for your line out of band. Anything still on 18.10 or older needs an upgrade path today, and should come off the internet until it’s done. GitLab published two detections for self-managed customers, keyed on Onigmo native worker crashes and bursts of Org mode render errors. Wire both into your SIEM and look back over the last two weeks. If anything fires, assume the git user ran code and rotate CI/CD variables, runner registration tokens, deploy keys and package registry credentials.
The read. Two max-severity bugs in one compiler in ten days usually means researchers have found a productive seam, and more variants tend to follow. If GitLab is your software factory, budget for another emergency patch window before year-end and move version inventory for the forge into the same tier as your VPN and domain controllers.