GitLab Update: Patch the CVSS-10 RCE Tonight — Self-Hosted Fix Guide (CVE-2026-110264)

Description and use

Upgrading self-hosted GitLab to the line-specific fixed build (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13) patches CVE-2026-110264, an integer overflow in the Onigmo regex compiler that could allow unauthenticated remote code execution. Verification confirms the patched version, all background migrations complete, and no Onigmo crashes appear in logs. If patching must wait, hardening steps (network isolation, restriction of public projects, deployment of GitLab detection rules, secret rotation) reduce exposure during the maintenance window.

Problem

CVE-2026-110264 is a Critical, CVSS 10.0 integer overflow in GitLab's Onigmo regex compiler that allows unauthenticated remote code execution on self-hosted GitLab instances from version 7.0 onward. Every self-hosted GitLab build below its line's fixed patch is exposed.

Outcome

Upgrading self-hosted GitLab to the line-specific fixed build (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13) patches CVE-2026-110264, an integer overflow in the Onigmo regex compiler that could allow unauthenticated remote code execution. Verification confirms the patched version, all background migrations complete, and no Onigmo crashes appear in logs. If patching must wait, hardening steps (network isolation, restriction of public projects, deployment of GitLab detection rules, secret rotation) reduce exposure during the maintenance window.

Workflow

• Check exact GitLab version via gitlab-rake gitlab:env:info | grep -i 'gitlab version' (Omnibus) or docker exec gitlab gitlab-rake gitlab:env:info | grep -i 'gitlab version' (Docker), then compare against your line's fixed build (19.5.x→19.5.1, 19.4.x→19.4.3, etc.)
• Back up before upgrading: Omnibus → sudo gitlab-backup-cli backup create; Docker → docker exec -t gitlab gitlab-backup-cli backup create then docker cp gitlab:/var/opt/gitlab/backups/ /safe/place/off/the/host/. Verify the backup file exists and has a sane size.
• Upgrade Docker: docker pull gitlab/gitlab-ce:<fixed-tag> (pin the tag, not :latest), stop and remove the old container, recreate with original volume mounts and ports, then wait for migrations to finish before using the web UI.
• Upgrade Omnibus: install the exact fixed package (sudo apt install gitlab-ce=<fixed-build> or sudo yum install gitlab-ce-<fixed-build>), then run sudo gitlab-ctl reconfigure. On single-node installs, GitLab stays down until migrations complete.
• Upgrade Helm: helm upgrade to the chart version mapping to your line's fixed app build; watch migration jobs complete before declaring victory.
• Verify: re-run the version check to confirm the fixed build; open Admin > Monitoring > Background Migrations and confirm every migration shows finished; check logs for Onigmo-related crashes ('Onigmo native worker crash', 'Org mode render error burst').

Evidence

On October 21, 2026, GitLab shipped a critical patch release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for Community and Enterprise Edition. The headline fix is CVE-2026-110264 — an integer overflow in the regex compiler that, in GitLab's own words, 'could have allowed an unauthenticated user to execute arbitrary code on the GitLab server.' Severity: Critical, CVSS 10.0. Every self-hosted GitLab from version 7.0 onward is exposed unless it's on a fixed build.

Source