CVE-2026-110264

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

CVSS

10.0

EPSS

0.005 (42.2th percentile)

CISA KEV

Not listed

Exploitation

none

Public exploits

None seen

State

PUBLISHED

Coverage

• Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards4 hours ago

  Ruby 3.3.13 Released

  Ruby 3.3.13 has been released. This release includes security fixes. Please check the topics below for details. Security advisories: CVE-2026-80212 and CVE-2026-80213 Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 This release updates…

  ↗ruby-lang.org/en/news/2026/10/23/ruby-3-3-13-re…(opens the publisher's site in a new tab)

• Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards5 hours ago

  Ruby 3.4.12 Released

  Ruby 3.4.12 has been released. This release includes fixes for bugs in Regexp compilation that GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577…

  ↗ruby-lang.org/en/news/2026/10/23/ruby-3-4-12-re…(opens the publisher's site in a new tab)

• Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards5 hours ago

  Ruby 4.0.9 Released

  Ruby 4.0.9 has been released. This release includes a fix for a bug in Regexp compilation that GitLab’s CVE-2026-110264 relies on. Please see the topic below for details. Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 Please see the…

  ↗ruby-lang.org/en/news/2026/10/23/ruby-4-0-9-rel…(opens the publisher's site in a new tab)

• Language blogs: Rust / Go / TypeScript / Swift / Kotlin / Java / .NET / Ruby / PHP / Elixir / ISO C++◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards5 hours ago

  Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264

  We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. GitLab published four CVEs for these issues, and the Ruby releases contain the fixes for the underlying…

  ↗ruby-lang.org/en/news/2026/10/23/regexp-fixes-f…(opens the publisher's site in a new tab)

What we observed