CVE-2026-110264: GitLab Org-mode regex integer overflow allows unauthenticated RCE

Critical 10.0 EPSS 1.3% GitLab CE/EE

GitLab CE/EE renders Org-mode files with the org-ruby gem, which builds a regular expression from an attacker-supplied #+TODO: keyword; a keyword with more than 32,767 repeats overflows a 16-bit counter in Ruby's Onigmo regex engine and causes an out-of-bounds write at match time. An unauthenticated attacker can turn this into code execution on the GitLab server as the git user, exposing gitlab-secrets.json, CI/CD variables, runner and access tokens, and every repository. GitLab rates it critical (CVSS 10.0); it affects every version since 7.0, and the fix is a patch to the Ruby that GitLab bundles (also in Ruby 4.0.9, 3.4.12, 3.3.13).

• CVE-2026-110264CVE identifier
• 10.0CVSS 3.1 base score (critical)
• 1.3%EPSS: chance of exploitation in the next 30 days (higher than 72% of CVEs)
• 2026-10-22published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• GitLab CE/EE 7.0 before 18.11.13
• GitLab CE/EE 19.0 before 19.0.10
• GitLab CE/EE 19.1 before 19.1.9
• GitLab CE/EE 19.2 before 19.2.9
• GitLab CE/EE 19.3 before 19.3.6
• GitLab CE/EE 19.4 before 19.4.3
• GitLab CE/EE 19.5 before 19.5.1

Fixed in:

• GitLab 19.5.1
• GitLab 19.4.3
• GitLab 19.3.6
• GitLab 19.2.9
• GitLab 19.1.9
• GitLab 19.0.10
• GitLab 18.11.13
• Ruby 4.0.9, 3.4.12, 3.3.13 (for installs using their own Ruby)

Am I affected?

sudo gitlab-rake gitlab:env:info
dpkg -l gitlab-ee gitlab-ce 2>/dev/null | grep ^ii
rpm -q gitlab-ee gitlab-ce
/opt/gitlab/embedded/bin/ruby -v

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update && sudo apt install gitlab-ee=19.5.1-ee.0
# other series: 19.4.x -> 19.4.3, 19.3.x -> 19.3.6, 19.2.x -> 19.2.9, 19.1.x -> 19.1.9, 19.0.x -> 19.0.10, 18.11.x -> 18.11.13
# Community Edition: sudo apt update && sudo apt install gitlab-ce=19.5.1-ce.0

sudo apt update && sudo apt install gitlab-ee=19.5.1-ee.0
# other series: 19.4.x -> 19.4.3, 19.3.x -> 19.3.6, 19.2.x -> 19.2.9, 19.1.x -> 19.1.9, 19.0.x -> 19.0.10, 18.11.x -> 18.11.13
# Community Edition: sudo apt update && sudo apt install gitlab-ce=19.5.1-ce.0

# RHEL/AlmaLinux/Oracle Linux 9 (use .el8 on EL8)
sudo dnf install gitlab-ee-19.5.1-ee.0.el9
# other series: 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
# Community Edition: sudo dnf install gitlab-ce-19.5.1-ce.0.el9

not packaged

not in distro repos: packages.gitlab.com gitlab-ce / gitlab-ee

not in distro repos: packages.gitlab.com gitlab-ee

sudo pacman -Syu

apk update && apk upgrade gitlab-runner (runner only)

pkg update && pkg upgrade gitlab-ce

# in docker-compose.yml set: image: gitlab/gitlab-ee:19.5.1-ee.0  (other series: 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13; CE: gitlab/gitlab-ce:<version>-ce.0)
docker compose pull
docker compose up -d

Self-compiled installs and custom images with their own Ruby: upgrading GitLab is not enough; also upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later (GitLab's fix is a patch to Ruby that only ships in the official packages and images).

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

Look for signs of exploitation

• GitLab security: look in the Puma worker error log (/var/log/gitlab/puma/puma_stderr.log on Omnibus; webservice container stderr on Helm) for native Ruby '[BUG]' crash reports whose backtrace includes org-ruby (headline.rb, parse_keywords) or Onigmo frames (match_at, onig_search_gpos, onig_compile). A crash corroborates an attempt, but successful exploitation is quiet and may not crash, so no crash does not prove safety.
• GitLab also published an 'Org mode render error burst' detection for bursts of Org-mode rendering errors.

Related vulnerabilities

• CVE-2026-97229
• CVE-2026-93577
• CVE-2026-89078

Sources

• GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
• Ruby: Regexp compilation fixes related to GitLab's CVEs
• GitLab detection: Onigmo native worker crash
• GitLab detection: Org mode render error burst
• GitLab issue 633633
• GitLab docs: upgrade a Linux package instance
• https://hackerone.com/reports/4093475
• CVE-2026-110264 on CVE.org
• CVE-2026-110264 on NVD

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.