Critical GitLab regex compiler flaw enables unauthenticated code execution across releases back to version 7.0

GitLab disclosed CVE-2026-110264, rated 10.0, which under certain conditions lets an unauthenticated user run arbitrary code on the server through an integer overflow while compiling a specially crafted regular expression. The flaw sits in Onigmo, the Ruby regex engine GitLab ships, and affects every release from 7.0 through 18.11 and the 19.x branches before their fixes, so it spans roughly twelve years of versions. Only self-managed installations must act; GitLab.com and Dedicated already run patched builds. Fixes are in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab reports no exploitation yet.

Check

Upgrade self-managed GitLab to the fixed release for your branch, such as 18.11.13 or 19.5.1, immediately, since GitLab.com and Dedicated are already patched.

Affected

Self-managed GitLab from version 7.0 through the unpatched 18.11 and 19.x builds lets an unauthenticated user run code via a crafted regular expression under certain conditions.

Fix

Apply the fixed GitLab release, restrict who can submit regex-bearing pipeline input where possible, and monitor the server for unexpected code execution.