GitLab CVE-2026-110264: which fixed version to pick

Every supported line got the fix for the no-login code execution bug. Only 19.3.6 and later got the other 11 fixes, and two of those are rated High.

GitLab shipped an out-of-band patch on October 21 for CVE-2026-110264, an integer overflow in its regular expression compiler rated CVSS 10.0. GitLab says that under certain conditions an unauthenticated user could run code on a self-managed server by getting it to compile a crafted regular expression. Every version from 7.0 is affected until the fixed release for its line. GitLab.com is already patched, as are Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later.

There were no known attacks as of October 22, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog. GitLab is a regular target, though: BleepingComputer notes that five GitLab flaws have gone on CISA's exploited list since November 2021, and Shadowserver tracks more than 2,700 GitLab CE instances open to the internet. A write-up by Lilting reads the bug as triggered by rendering a crafted Org-mode (.org) file, with no login needed. One of GitLab's two detections for it is named "Org mode render error burst."

This is the second CVSS 10 regex bug from the same researcher, joaxcar, in about ten days, BleepingComputer reports. Rescana and Lilting note that instances patched for CVE-2026-97229 on October 12 (19.4.2, 19.3.5, 19.2.8) are still exposed and need to upgrade again.

The backport gap

The release holds 12 fixes. GitLab pushed the critical one back to four older lines, 18.11.13, 19.0.10, 19.1.9 and 19.2.9, but the other 11 fixes are in 19.3.6, 19.4.3 and 19.5.1 only. GitLab's own affected-version ranges show what that leaves open on the older lines:

CVE-2026-15723 (High, 8.2): with OmniAuth SAML and LDAP auto-linking both switched on, a signed-in user could hijack another person's LDAP-backed account. Affected from 10.1 to versions before 19.3.6.
CVE-2026-112212 (High, 7.5): someone with no account could plant a bad OAuth/OIDC discovery document in a shared cache and send some sign-in flows to an outside server. Affected from 18.3 to versions before 19.3.6.
CVE-2026-16255 (Medium, 5.9, Enterprise Edition): the SAML or LDAP membership lock is not fully enforced. Affected from 12.0 to versions before 19.3.6.

So a team on 19.1 that installs 19.1.9 closes the code execution hole and stays exposed to the other three.

Which version to move to

You run	Fixes the CVSS 10 bug	Fixes everything in this release
19.5	19.5.1	19.5.1
19.4	19.4.3	19.4.3
19.3	19.3.6	19.3.6
19.2, 19.1, 19.0, 18.11	19.2.9, 19.1.9, 19.0.10, 18.11.13	19.3.6 or later
18.10 or older	No fix on your line; upgrade through the required stops	19.3.6 or later

Budget for downtime. 19.3.6 and 19.4.3 run database migrations, and GitLab says single-node servers stay down until they finish. Multi-node setups can use the zero-downtime upgrade process. InfoWorld counts this as the fourth critical GitLab issue in about two months.

What IT teams should do

List every self-managed GitLab server, including ones run by vendors and contractors, and its version. Internet-facing servers and those with public projects go first.
Apply the backport for your line today if a jump to 19.3.6 needs a change window. Then plan the move to 19.3.6 or later, sooner if you use SAML with LDAP auto-linking or OAuth/OIDC sign-in.
Turn on GitLab's two detections for this bug, one for Onigmo worker crashes and one for bursts of Org mode render errors. No alert does not prove a server is clean, Rescana warns. Astra also advises watching for odd child processes under Puma, Sidekiq or Workhorse.
If you find signs of code execution, treat the server as compromised: rotate the instance secrets, runner and access tokens, and every CI/CD variable.

GitLab CVSS 10 fix: on 19.2 or older, two High flaws stay open

The backport gap

Which version to move to

What IT teams should do

Sources