GitLab disclosed CVE-2026-110264, rated 10.0, which under certain conditions lets an unauthenticated user run arbitrary code on the server through an integer overflow while compiling a specially crafted regular expression. The flaw sits in Onigmo, the Ruby regex engine GitLab ships, and affects every release from 7.0 through 18.11 and the 19.x branches before their fixes, so it spans roughly twelve years of versions. Only self-managed installations must act; GitLab.com and Dedicated already run patched builds. Fixes are in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab reports no exploitation yet.
GitLab disclosed CVE-2026-97229, a critical integer overflow in the CI/CD regular expression compiler that parses and evaluates regular expressions in pipeline configuration files. Under certain conditions, an unauthenticated user can execute arbitrary code on the GitLab server through a specially crafted regular expression. It affects versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, with fixes in 19.2.8, 19.3.4, and 19.4.2. Self-managed installations must upgrade immediately, while GitLab.com already runs the patched version and Dedicated customers need no action. A researcher reported it through GitLab's HackerOne program, and no exploitation is reported.
TrustStrike Labs