Integer Overflow or Wraparound in GitLab
GitLab GitLabApplications & CMSWhat fixes it
- 18.11.13GitLabCVE List
- 19.0.10GitLabCVE List
- 19.1.9GitLabCVE List
- 19.2.9GitLabCVE List
- 19.3.6GitLabCVE List
- 19.4.3GitLabCVE List
Show all 7 fixed versions
- 19.5.1GitLabCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 22 Oct 2026, 00:33 UTCPublishedCVE List
- 22 Oct 2026, 18:22 UTCExploit code publicGitHub proof-of-concept repositories
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Reports 9
4 outlets mention it. Reports are not confirmation; each links to its source.
- @wojak7537.bsky.social: Ruby 3.4.12 was released on 23 Oct 2026, fixing Regexp compilation bugs that GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on.Bluesky: CVE posts, 24 Oct 2026
- googlesky/CVE-2026-110264: PoC, reproducible labs, live evidence, Nuclei fingerprint, and technical report for CVE-2026-110264 — GitLab Org-mode/Onigmo unauthenticated RCE (CVSS 10.0); render oracle validated on GitLab CE 19.3.1.GitHub proof-of-concept repositories, 24 Oct 2026Exploit code
- lesterlam/onigmo-cve-2026-110264: Reproduction lab for CVE-2026-110264 - the 16-bit ID overflow in Onigmo, the regexp engine Ruby bundles (GitLab CE/EE, CVSS 10.0). Standalone engine build + A/B against the vendor fix. Trigger condition onlGitHub proof-of-concept repositories, 23 Oct 2026Exploit code
- Ruby 3.3.13 ReleasedRuby, 23 Oct 2026
- Ruby 3.4.12 ReleasedRuby, 23 Oct 2026
- Ruby 4.0.9 ReleasedRuby, 23 Oct 2026
- Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264Ruby, 23 Oct 2026
- al4n4n/CVE-2026-110264: CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.GitHub proof-of-concept repositories, 22 Oct 2026Exploit code
- GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13GitLab releases, 21 Oct 2026
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Text from CVE List
Affected versions 7
- GitLabaffected: 7.0 before 18.11.13CVE List
- GitLabaffected: 19.0 before 19.0.10CVE List
- GitLabaffected: 19.1 before 19.1.9CVE List
- GitLabaffected: 19.2 before 19.2.9CVE List
- GitLabaffected: 19.3 before 19.3.6CVE List
- GitLabaffected: 19.4 before 19.4.3CVE List
- GitLabaffected: 19.5 before 19.5.1CVE List