--- schema: 1 kind: vulnerability title: "CVE-2026-110264, GitLab CE/EE: an unauthenticated code-execution flaw in the Org-mode renderer's regular-expression handling, fixed in 19.5.1, 19.4.3 and 19.3.6 and backported to four older lines (CVSS 10.0)" headline: "GitLab's critical patch fixes an unauthenticated CVSS 10.0 RCE in Org-mode rendering; no exploitation reported" summary: > GitLab's critical patch release of 2026-10-21 fixes CVE-2026-110264 (CVSS 3.1 10.0), an integer overflow in regular-expression handling that lets an unauthenticated user run code on a self-managed GitLab server as the git user; GitLab's own detection write-ups place it in the rendering of .org files, which needs only a public project that can hold the payload. Every version from 7.0 before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 is affected, so instances on the 19.4.2, 19.3.5 and 19.2.8 builds that closed the earlier regular-expression flaws still need this release. GitLab does not report exploitation. discovered_at: "2026-10-22T03:42:00Z" updated_at: null event_date: "2026-10-21" run_id: 2026-10-22T0256Z-intel priority: notable immediate_action: null tags: [vulnerabilities, rce, pre-auth, patch-available] regions: [global] sectors: [] entities: ["product:gitlab", "product:gitlab-ce", "product:gitlab-ee"] techniques: [T1190] affected_products: ["GitLab Community Edition", "GitLab Enterprise Edition"] cves: - id: CVE-2026-110264 cvss: "10.0 (CVSS 3.1)" epss: null type: rce vector: zero-click auth: pre-auth status: [patch-available] affected: "all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1" fixed: "19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13" sources: - url: "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" publisher: "GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13)" date: "2026-10-21" role: primary - url: "https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md" publisher: "GitLab security (detection: Org-mode render error burst)" date: "2026-10-21" role: corroborating - url: "https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md" publisher: "GitLab security (detection: Onigmo native worker crash)" date: "2026-10-21" role: corroborating closed_sources: [] evidence: - quote: "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression." publisher: "GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13)" source_url: "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" - quote: "all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1" publisher: "GitLab (Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13)" source_url: "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" - quote: "only one public project that can hold the .org payload" publisher: "GitLab security (detection: Org-mode render error burst)" source_url: "https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md" - quote: "a successful CVE-2026-110264 exploit is quiet and does not reliably crash" publisher: "GitLab security (detection: Onigmo native worker crash)" source_url: "https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md" verification: single-source sourcing_note: > GitLab is the first-party source for its own flaw: the patch notes carry the affected and fixed versions and the score, and the two detection write-ups carry the mechanism. No third party has reported the flaw yet, and GitLab does not state that it is exploited. confidence: high references: - "2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce" deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every self-managed GitLab CE and EE instance to 19.5.1, 19.4.3, 19.3.6 or the backport for its line (19.2.9, 19.1.9, 19.0.10, 18.11.13) now, internet-reachable instances and instances with public projects first; builds 19.4.2, 19.3.5 and 19.2.8 are still affected." updates: [] migrated_from: null --- GitLab's ad-hoc critical patch release of 2026-10-21 fixes CVE-2026-110264 (CVSS 3.1 10.0), an integer overflow while compiling a specially crafted regular expression that could let an unauthenticated user execute code on the GitLab server ([GitLab, 2026-10-21](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)). GitLab's detection write-ups place the flaw in the rendering of Org-mode files: the org-ruby gem builds a regular expression from a custom TODO keyword in a .org file, a keyword with more than 32,767 repeats makes the Onigmo engine write out of bounds when it matches, and with heap grooming that becomes command execution as the git user ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md)). The attack needs no authentication, only one public project that can hold the .org payload ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md)). Affected are all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1; GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action ([GitLab, 2026-10-21](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)). The builds 19.4.2, 19.3.5 and 19.2.8 from GitLab's earlier regular-expression fixes do not contain this fix ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md)). GitLab does not state that the flaw is exploited, and its patch notes and detection pages mention no public proof of concept ([GitLab, 2026-10-21](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)). **Exposure:** self-managed GitLab CE and EE on the versions above; the vulnerable path is reached when GitLab renders a .org file, so an instance with public projects, or one where untrusted users can create them, is the exposed shape, and until patching GitLab advises reducing public visibility ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md)). **Detection:** GitLab's two detections key on, first, five or more render timeouts from the Org-mode renderer on .org files from one client within 30 minutes in the Rails exceptions log, with the request that actually crashes a worker visible only as a 502 on the .org blob route in the Workhorse log, and second, a native Ruby crash report in the Puma error log whose backtrace runs through org-ruby or Onigmo frames ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md)). In repository content, scan each suspect checkout for .org files with an oversized TODO-keyword line, and in the Rails request log look for editor preview requests whose file_path ends in .org while the URL names another file type, which forces the Org renderer ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md)). A successful exploit is quiet and does not reliably crash, so the absence of a hit never clears an instance ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md)). On an exposed, unpatched instance, hunt for unexpected child processes of Puma, new files owned by git in the temporary directory, outbound connections and changed crontabs or SSH keys for the git user, and treat the secrets, CI/CD variables, runner tokens and access tokens the git user can read as at risk ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md)). **Triage:** a reader of documentation .org files renders each file once and quickly, while an attack produces a burst of timeouts from one client over a few minutes ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md)); a worker crash with no accompanying render burst from one client is more likely a benign parser bug than an attack ([GitLab security, 2026-10-21](https://gitlab.com/gitlab-security-oss/tldr/-/raw/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md)). **Defender takeaway:** upgrade to the fixed build of the instance's line now, internet-reachable instances and those with public projects first; an instance that moved to 19.4.2, 19.3.5 or 19.2.8 for the earlier flaws is not yet fixed for this one ([GitLab, 2026-10-21](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)).