Description
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 7.0 – < 18.11.13, 19.0 – < 19.0.10, 19.1 – < 19.1.9, 19.2 – < 19.2.9, 19.3 – < 19.3.6, 19.4 – < 19.4.3, 19.5 – < 19.5.1 | 18.11.13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby3.3 | No fix yet | — |
| Debian 13 | ruby3.3 | 3.3.13-0+deb13u1 | — |
| Debian 12 | ruby3.1 | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ruby +5 | 3.3.13-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | ruby4.0 +2 | 4.0.9-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | ruby4.0-rubygem-pg | 1.6.3-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-irb | 1.13.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-json | 2.7.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-psych | 5.1.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-racc | 1.7.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rake | 13.1.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rss | 0.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygems +1 | 3.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 9 | ruby +4 | 3.0.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bigdecimal | 3.0.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bundler | 2.2.33-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-io-console | 0.5.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-irb | 1.3.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-json | 2.5.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-minitest | 5.14.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-mysql2 +1 | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:96120, ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-pg +1 | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:96120, ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-power_assert | 1.2.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-psych | 3.3.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rake | 13.0.3-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rbs | 1.4.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rdoc | 6.3.4.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rexml | 3.2.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rss | 0.2.9-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-test-unit | 3.3.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-typeprof | 0.15.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygems +1 | 3.2.33-170.el9_8 | ALSA-2026:96067 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ruby | 3.3.13-16.el10_2 | RLSA-2026:96235 |
| Rocky Linux 10 | ruby4.0 | 4.0.9-38.el10_2 | RLSA-2026:96233 |
| Rocky Linux 9 | ruby | 3.0.7-170.el9_8 | RLSA-2026:96067 |
| Rocky Linux 9 | rubygem-mysql2 | 0.5.5-3.module+el9.7.0+40032+36e56d0d | RLSA-2026:96120, RLSA-2026:96068 |
| Rocky Linux 9 | rubygem-pg | 1.5.4-2.module+el9.7.0+40188+314ad260.0.1 | RLSA-2026:96120, RLSA-2026:96068 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ruby | 3.4.12-r0 | — |
| Alpine v3.23 | ruby | 3.4.12-r0 | — |
| Alpine v3.22 | ruby | 3.4.12-r0 | — |
| Alpine v3.21 | ruby | 3.3.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ruby3.4 +5 | 3.4.12-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bigdecimal | 3.1.8-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bundler | 2.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-io-console | 0.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-irb | 1.14.3-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-json | 2.9.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-minitest | 5.25.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-power_assert | 2.0.5-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-psych | 5.2.2-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-racc | 1.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rake | 13.2.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rbs | 3.8.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rdoc | 6.14.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rexml | 3.4.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rss | 0.3.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-test-unit | 3.6.7-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-typeprof | 0.30.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygems +1 | 3.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby4.0 +6 | 4.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-io-console | 0.8.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-irb | 1.16.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-json | 2.18.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-minitest | 6.0.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-power_assert | 3.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-psych | 5.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-racc | 1.8.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rake | 13.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rbs | 3.10.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rdoc | 7.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rexml | 3.4.4-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rss | 0.3.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-test-unit | 3.7.5-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-typeprof | 0.31.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygems +2 | 4.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2 | ruby +5 | 2.0.0.648-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygem-bigdecimal | 1.2.0-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygem-io-console | 0.4.2-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygem-json | 1.7.7-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygem-minitest | 4.3.2-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygem-psych | 2.0.0-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygem-rake | 0.9.6-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygem-rdoc | 4.0.0-36.amzn2.0.22 | ALAS2-2026-4091 |
| Amazon Linux 2 | rubygems +1 | 2.0.14.1-36.amzn2.0.22 | ALAS2-2026-4091 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ruby | 3.3.13-0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ruby +5 | 3.3.13-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | ruby4.0 +2 | 4.0.9-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | ruby4.0-rubygem-pg | 1.6.3-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-irb | 1.13.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-json | 2.7.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-psych | 5.1.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-racc | 1.7.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rake | 13.1.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rss | 0.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygems +1 | 3.5.22-16.el10_2 | ELSA-2026-96235 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-runner-19.3 +5 | 19.3.5-r0 | — |
| Wolfi rolling | ruby-3.3 +2 | 3.3.12-r10 | — |
| Wolfi rolling | ruby-3.4 +2 | 3.4.11-r5 | — |
| Wolfi rolling | ruby-4.0 +2 | 4.0.7-r6 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 12 repositories · most starred shown
-
al4n4n/CVE-2026-110264 ★ 4 · Oct 22, 2026
CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.
-
googlesky/CVE-2026-110264 ★ 0 · Oct 24, 2026
PoC, reproducible labs, live evidence, Nuclei fingerprint, and technical report for CVE-2026-110264 — GitLab Org-mode/Onigmo unauthenticated RCE (CVSS 10.0); render oracle validated on GitLab CE 19.3…
-
FranklinF25/regex2shell ★ 0 · Oct 23, 2026
regex2shell (CVE-2026-110264 + family) — GitLab/Onigmo unauth regex RCE research: safe differential detector, deterministic interpreter kill, match-time write primitive
-
bastet-ai/gitlab-firing-range ★ 0 · Oct 23, 2026
Authorized loopback-only Docker firing range for CVE-2026-110264 (Onigmo regex integer-overflow, unauth RCE) research + detection engineering
-
lesterlam/onigmo-cve-2026-110264 ★ 0 · Oct 23, 2026
Reproduction lab for CVE-2026-110264 - the 16-bit ID overflow in Onigmo, the regexp engine Ruby bundles (GitLab CE/EE, CVSS 10.0). Standalone engine build + A/B against the vendor fix. Trigger condit…
-
TheGlitchFixer/gitlab-patch-check ★ 0 · Oct 23, 2026
Check whether your self-hosted GitLab version is patched against CVE-2026-110264 (CVSS 10.0 RCE) — companion script for The Homelab Fixer guide.
-
farimazhar/GitLab2Safe-Defensive-Checker ★ 0 · Oct 23, 2026
100% Defensive Scanner for CVE-2026-110264 GitLab Arbitrary File Write (PHP2Shell) - No exploit code, only version & patch detection for security teams and learners.
-
TahuCryptsi/gitlab-onigmo-check ★ 0 · Oct 22, 2026
Local detector for CVE-2026-110264 (GitLab Onigmo regex repeat-ID overflow, CVSS 10.0 unauth RCE). One-file Ruby check + real crash transcript.
-
xaviware/go-gitlab-cve-2026-110264-scanner ★ 0 · Oct 22, 2026
Fast, concurrent, non-intrusive exposure auditor in Go for the GitLab CE/EE unauthenticated RCE (CVE-2026-110264, CVSS 10.0). For defensive use.
-
TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264 ★ 0 · Oct 22, 2026
CVE-2026-110264 — GitLab Unauthenticated RCE (Onigmo regex repeat-ID overflow, CVSS 10.0). Docker-verified crash PoC on ruby 3.4.11 + measured heap analysis. Crash-level, non-weaponized.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 18
- RLSA-2026:96233 Moderate: ruby4.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96067 Moderate: ruby security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- WID-SEC-2026-4115 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-4416 Ruby: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96120 Moderate: ruby:4.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96233 Moderate: ruby4.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96067 Moderate: ruby security update AlmaLinux Security Advisories · Nov 9, 2026
- ALAS2023-2026-3400 Important: ruby4.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3413 Important: ruby3.4 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2-2026-4091 Important: ruby security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- RLSA-2026:96120 Moderate: ruby:4.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 9, 2026
- RLSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 9, 2026
- ELSA-2026-96233 Moderate: ruby4.0 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96235 Moderate: ruby security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- NCSC-2026-0447 Kwetsbaarheden verholpen in GitLab door GitLab Inc. NCSC-NL (Netherlands) · Oct 22, 2026
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/633633
- HackerOne Bug Bounty Report #4093475 technical-description exploit permissions-required
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/