CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)

GitLab's ad-hoc critical patch release of 2026-10-21 fixes CVE-2026-110264 (CVSS 3.1 10.0), an integer overflow while compiling a specially crafted regular expression that could let an unauthenticated user execute code on the GitLab server (GitLab, 2026-10-21). GitLab's detection write-ups place the flaw in the rendering of Org-mode files: the org-ruby gem builds a regular expression from a custom TODO keyword in a .org file, a keyword with more than 32,767 repeats makes the Onigmo engine write out of bounds when it matches, and with heap grooming that becomes command execution as the git user (GitLab security, 2026-10-21). The attack needs no authentication, only one public project that can hold the .org payload (GitLab security, 2026-10-21). Affected are all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1; GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action (GitLab, 2026-10-21). The builds 19.4.2, 19.3.5 and 19.2.8 from GitLab's earlier regular-expression fixes do not contain this fix (GitLab security, 2026-10-21). GitLab does not state that the flaw is exploited, and its patch notes and detection pages mention no public proof of concept (GitLab, 2026-10-21).

Triage: a reader of documentation .org files renders each file once and quickly, while an attack produces a burst of timeouts from one client over a few minutes (GitLab security, 2026-10-21); a worker crash with no accompanying render burst from one client is more likely a benign parser bug than an attack (GitLab security, 2026-10-21).