GitLab issues emergency patches for maximum severity CVSS 10.0 integer overflow RCE

GitLab releases emergency out-of-band updates for maximum severity CVSS 10.0 regular expression compiler RCE

GitLab has published an emergency out-of-band security advisory remediating an unauthenticated remote code execution vulnerability assigned the maximum severity CVSS score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Tracked as CVE-2026-110264, the flaw resides in the platform regular expression compilation engine, where an arithmetic integer overflow allows an unauthenticated remote adversary to corrupt process memory and execute arbitrary code on the underlying host by submitting crafted regular expression patterns through unauthenticated rendering endpoints.

The vulnerability represents one of the most expansive historical security exposures in DevSecOps history. The underlying weakness spans every version of GitLab Community Edition (CE) and Enterprise Edition (EE) released across a 12.42-year window (4,535 days), originating in GitLab 7.0 released in May 2014. Because standard GitLab security maintenance policy only provides backported patches for the current release and the previous two minor versions, GitLab took the exceptional step of backporting fixes across seven active release streams, extending remediation back to version 18.11.13 to prevent enterprise supply chain compromise.

Technical execution architecture and memory corruption autopsy

Zoom

Epistemic audit of verified vendor disclosures versus threat capabilities

Due to the extreme severity of CVE-2026-110264 and its potential for mass exploitation against private corporate source code repositories, security leadership must differentiate between verified vendor disclosures and operational attack capabilities.

Audit of verified technical disclosures in GitLab emergency release versus operational assumptions

Architectural Dimension	Explicitly Confirmed by GitLab	Forensically Derived / Not Disclosed
Vulnerability Root Cause	Integer overflow issue occurring during the compilation of a specially crafted regular expression inside GitLab CE/EE.	Root cause resides in native C regex parsing library (Onigmo) utilized by MRI Ruby runtimes (Ruby 3.3, 3.4, and 4.0), specifically in repeat-range stack allocations.
Attack Vector and Prerequisites	Network accessible, low attack complexity, requiring zero privileges and zero user interaction (CVSS 10.0 score).	Ingress is reachable through markdown rendering, wiki document parsers, and Org mode preview endpoints that parse untrusted user text into regex matchers.
Affected Version Lifespan	All versions from 7.0 prior to 18.11.13, and recent releases up to 19.5 prior to 19.5.1.	Represents 4,535 continuous days of code exposure (12.42 years) dating back to May 2014, impacting legacy on-premises servers across global enterprises.
Post-Exploitation Execution Scope	Arbitrary code execution on the GitLab server under the privileges of the running application worker.	Execution typically occurs within the git system user context, granting direct read access to production databases, repository storage disks, and CI/CD runner registration tokens.
Active In-the-Wild Exploitation	GitLab advisory does not indicate active in-the-wild exploitation at the time of patch release.	Public proof-of-concept exploit generation is anticipated rapidly due to detailed diffs available across the seven backported Omnibus and Cloud Native GitLab merge requests.

Granular five-phase technical autopsy of the integer overflow execution chain

The execution chain of CVE-2026-110264 operates through an unauthenticated memory corruption flow within the native regular expression compilation routines of the Ruby runtime. A detailed examination of the five discrete operational phases demonstrates how an external adversary transitions from a simple HTTP request to full host compromise.

Phase 1: Ingestion Vector and Untrusted Document Parsing

GitLab incorporates extensive document rendering and text transformation features designed to render project documentation, issues, wiki pages, and merge requests. Among these format processors is the Org mode rendering pipeline (supported natively via Ruby gems such as org-ruby and GitLab custom markup formatters). When an unauthenticated client submits content to public project endpoints or requests the server-side preview of a document, the input string is ingested by the GitLab Rails application and forwarded to background Puma web workers or Sidekiq asynchronous queues for text normalization.

Phase 2: Onigmo Native Parser Integer Overflow Mechanics

During pattern matching, the Ruby MRI runtime delegates regular expression parsing to Onigmo, a native C regular expression library that replaced Oniguruma. When compiling a regular expression containing deeply nested quantified groups with excessive repetition parameters, the Onigmo compiler calculates the memory required for repeat-range tracking stacks.

Because the internal calculation performs an arithmetic multiplication on unsigned 32-bit integers without adequate overflow checks, the resulting buffer size wraps around zero. For example, when calculating stack memory for nested repetition blocks where multipliers exceed the maximum value of a 32-bit integer (4,294,967,295), the allocated memory buffer truncates to a trivial size (such as a few hundred bytes), while the compilation engine assumes the full buffer allocation succeeded.

Phase 3: Heap Corruption and Repeat-Range Double Free

With an undersized heap buffer allocated, the Onigmo parser proceeds to populate repeat-range identifiers into the repeat stack (repeat_stk). As compilation continues, the parser writes execution tokens and memory pointers far beyond the allocated heap boundary, overwriting adjacent heap chunks, metadata headers, and function pointer tables within the Puma worker process space.

Upon encountering an invalid pattern state or parsing termination, the engine executes cleanup routines. Because internal stack pointers were corrupted during the overflow, the deallocation routine attempts to free memory blocks that were either already freed or belong to external application structures, creating a classic repeat-range double-free condition. By precisely controlling the pattern string layout, an attacker transforms this memory corruption into predictable pointer redirection.

Phase 4: Post-Exploitation Execution and CI/CD Runner Takeover

Once arbitrary native code execution is achieved, the payload executes with the privileges of the running GitLab worker process, typically the unprivileged git system user. However, within an enterprise GitLab architecture, the git user possesses complete local control over vital DevSecOps assets:

1. Direct Access to Repository Storage: Unrestricted read and write access to all bare Git repositories hosted on the instance, bypassing repository access control lists and branch protection rules.
2. Database Credential Harvesting: Immediate access to /etc/gitlab/gitlab-secrets.json and PostgreSQL configuration files, allowing extraction of database encryption keys, personal access tokens, and webhook secrets.
3. CI/CD Shared Runner Hijacking: Harvesting of instance-wide runner registration tokens. Adversaries can register rogue runners or intercept pending CI/CD jobs, enabling the theft of cloud provider credentials (such as AWS STS tokens, GCP service account keys, and Azure service principals) injected into pipeline environment variables.

Phase 5: Companion Vulnerabilities and Multi-Vector Authentication Collapse

The 19.5.1 emergency release also remediated ten additional vulnerabilities, including critical companion flaws that compound an organization exposure:

• CVE-2026-15723 (CVSS 8.2): An improper authentication vulnerability in OmniAuth-to-LDAP auto-linking. When both OmniAuth SAML and LDAP auto-linking are enabled, an authenticated user can hijack an existing LDAP-backed enterprise account without interaction from the victim, caused by improper input sanitization during LDAP email lookup.
• CVE-2026-112212 (CVSS 7.5): A cache poisoning vulnerability in OAuth and OIDC discovery endpoints, allowing an unauthenticated attacker to poison shared discovery documents and redirect single sign-on flows to an adversary-controlled server.
• CVE-2026-16255 (CVSS 5.9): Incomplete enforcement of instance-wide SAML and LDAP membership locks, allowing unauthorized users to accept project and group memberships outside the enterprise identity provider.

Threat hunting signatures and forensic detection engineering

GitLab Security Engineering has published two dedicated threat detection signatures to enable incident response teams to identify exploitation attempts on self-managed infrastructure prior to patching.

# 1. Detect Onigmo native worker crashes in system message logs
grep -E 'puma.*segfault|sidekiq.*segfault' /var/log/messages /var/log/syslog

# 2. Audit GitLab Rails production log for Puma worker termination (Signal 11)
grep -E 'worker [0-9]+ died with status 11' /var/log/gitlab/gitlab-rails/production.log

# 3. Detect Org mode rendering exception bursts in Sidekiq logs
grep -E 'Orgmode::ParserError|RegexpError' /var/log/gitlab/sidekiq/current | cut -d' ' -f1-3 | sort | uniq -c | sort -nr

# 4. Inspect anomalous outbound network connections from the git user
ss -tupn | grep -E 'users:.*"(puma|sidekiq|ruby)"'

# 5. Check integrity of Omnibus Ruby binary packages
find /opt/gitlab/embedded/lib/ruby -name 'libruby*.so*' -print0 | xargs -0 md5sum

The primary indicator of exploit probing is the abnormal termination of Puma web workers with SIGSEGV (signal 11) exit codes. When an exploit payload miscalculates memory alignment during the integer overflow attempt, the native thread triggers an immediate segmentation fault, forcing Puma worker management to spawn a replacement worker process. A rapid succession of worker respawns coupled with spikes in Org mode parser exceptions represents high-fidelity evidence of exploitation.

Emergency patch resolution and migration impact matrix

To remediate CVE-2026-110264 and companion vulnerabilities, GitLab administrators must upgrade to one of the seven designated release trains immediately. Standard upgrade procedures must account for database schema migrations included in this release.

Emergency patch release matrix and database migration requirements across seven trains

Active Version Train	Remediated Target Version	Migration Impact	Downtime Requirement
GitLab 19.5	19.5.1	Patch release without schema migrations	Zero downtime for multi-node; brief restart for single-node
GitLab 19.4	19.4.3	Includes regular migrations and post-deploy migrations	Requires pre-migration checks; downtime required for single-node
GitLab 19.3	19.3.6	Includes regular database migrations	Downtime required for single-node deployments
GitLab 19.2	19.2.9	Exceptional backport patch	Zero downtime for multi-node deployments
GitLab 19.1	19.1.9	Exceptional backport patch	Zero downtime for multi-node deployments
GitLab 19.0	19.0.10	Exceptional backport patch	Zero downtime for multi-node deployments
GitLab 7.0 through 18.11	18.11.13	Critical backport for legacy installations	Follow standard legacy upgrade paths and verify Omnibus dependencies