GitLab CE/EE Org-mode renderer regular-expression integer overflow: unauthenticated code execution (CVSS 10.0); fixed in 19.5.1, 19.4.3, 19.3.6 and backports to four older lines

cve · CVE-2026-110264 single-source

Coverage

first 2026-10-22 → last 2026-10-22

Latest activity

2026-10-22

GitLab's critical patch fixes an unauthenticated CVSS 10.0 RCE in Org-mode rendering; no exploitation reported

Peak priority

notable

1 notable

Targets

no sector or region stated

Sources cited

2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-110264, newest first. Check the date before acting on an older one.

Upgrade every self-managed GitLab CE and EE instance to 19.5.1, 19.4.3, 19.3.6 or the backport for its line (19.2.9, 19.1.9, 19.0.10, 18.11.13) now, internet-reachable instances and instances with public projects first; builds 19.4.2, 19.3.5 and 19.2.8 are still affected.
2026-10-22CVE-2026-110264

Defender insights

What each entry about CVE-2026-110264 tells a defender to do, newest first.

2026-10-22NOTABLEGitLab's critical patch fixes an unauthenticated CVSS 10.0 RCE in Org-mode rendering; no exploitation reported

Exposure · triage · detection

Detection

GitLab's two detections key on, first, five or more render timeouts from the Org-mode renderer on .org files from one client within 30 minutes in the Rails exceptions log, with the request that actually crashes a worker visible only as a 502 on the .org blob route in the Workhorse log, and second, a native Ruby crash report in the Puma error log whose backtrace runs through org-ruby or Onigmo frames (GitLab security, 2026-10-21). In repository content, scan each suspect checkout for .org files with an oversized TODO-keyword line, and in the Rails request log look for editor preview requests whose file_path ends in .org while the URL names another file type, which forces the Org renderer (GitLab security, 2026-10-21). A successful exploit is quiet and does not reliably crash, so the absence of a hit never clears an instance (GitLab security, 2026-10-21). On an exposed, unpatched instance, hunt for unexpected child processes of Puma, new files owned by git in the temporary directory, outbound connections and changed crontabs or SSH keys for the git user, and treat the secrets, CI/CD variables, runner tokens and access tokens the git user can read as at risk (GitLab security, 2026-10-21).

Story timeline

2026-10-22CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)
trending-vulnerabilitiesGitLab's critical patch fixes an unauthenticated CVSS 10.0 RCE in Org-mode rendering; no exploitation reported

Hunting pivots

Affected products

GitLab Community Edition GitLab Enterprise Edition

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-22/cve-2026-110264-gitlab-org-mode-renderer-unauth-rce · ATT&CK page ↗

Entries about GitLab CE/EE Org-mode renderer regular-expression integer overflow: unauthenticated code execution (CVSS 10.0); fixed in 19.5.1, 19.4.3, 19.3.6 and backports to four older lines (1)

2026-10-22 · view entry permalink →

NOTABLECVE-2026-110264NATOA2

CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)

GitLab's ad-hoc critical patch release of 2026-10-21 fixes CVE-2026-110264 (CVSS 3.1 10.0), an integer overflow while compiling a specially crafted regular expression that could let an unauthenticated user execute code on the GitLab server (GitLab, 2026-10-21). GitLab's detection write-ups place the flaw in the rendering of Org-mode files: the org-ruby gem builds a regular expression from a custom TODO keyword in a .org file, a keyword with more than 32,767 repeats makes the Onigmo engine write out of bounds when it matches, and with heap grooming that becomes command execution as the git user (GitLab security, 2026-10-21). The attack needs no authentication, only one public project that can hold the .org payload (GitLab security, 2026-10-21). Affected are all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1; GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action (GitLab, 2026-10-21). The builds 19.4.2, 19.3.5 and 19.2.8 from GitLab's earlier regular-expression fixes do not contain this fix (GitLab security, 2026-10-21). GitLab does not state that the flaw is exploited, and its patch notes and detection pages mention no public proof of concept (GitLab, 2026-10-21).

Detection

Triage: a reader of documentation .org files renders each file once and quickly, while an attack produces a burst of timeouts from one client over a few minutes (GitLab security, 2026-10-21); a worker crash with no accompanying render burst from one client is more likely a benign parser bug than an attack (GitLab security, 2026-10-21).

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1

GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) 2026-10-21

only one public project that can hold the .org payload

GitLab security (detection: Org-mode render error burst) 2026-10-21

a successful CVE-2026-110264 exploit is quiet and does not reliably crash

GitLab security (detection: Onigmo native worker crash) 2026-10-21

Builds on: GitLab's CVSS 10.0 CI regex flaw now has a public PoC; the demonstrated path needs push access…

vulnerability22 Oct 03:42Zsingle-sourceOpen finding →

Sources: GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) · GitLab security (detection: Org-mode render error burst) · GitLab security (detection: Onigmo native worker crash)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

GitLab×1
productproduct:gitlab
GitLab CE×1
productproduct:gitlab-ce
GitLab EE×1
productproduct:gitlab-ee

Where this entity is cited

Vulns1

Source distribution

gitlab.com2 (67%)
docs.gitlab.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)