GitLab CVE-2026-110264 (CVSS 10, unauthenticated RCE in the regular expression compiler): which self-managed versions are affected and what do I upgrade to?

Am I affected? Yes if you run self-managed GitLab CE or EE older than the October 21, 2026 patch release on your branch. The bug is an integer overflow in the regular expression engine GitLab uses (Onigmo), and it reaches back to GitLab 7.0. Servers patched on October 12 for the earlier critical flaw (CVE-2026-97229) are still affected. GitLab.com and GitLab Dedicated were already protected. How to check: - Admin area > Dashboard shows the version, or run: sudo gitlab-rake gitlab:env:info (Omnibus) / check the image tag (Docker, Helm). Fix: upgrade to at least the fixed version on your line: - 19.5.x -> 19.5.1 - 19.4.x -> 19.4.3 - 19.3.x -> 19.3.6 - 19.2.x -> 19.2.9 - 19.1.x -> 19.1.9 - 19.0.x -> 19.0.10 - 18.11.x and older -> 18.11.13 (or move to a supported 19.x line) The same release fixes 11 other CVEs, so apply it even if you think the regex path isn't reachable on your instance. Interim mitigation: GitLab has not published a configuration workaround. If you can't upgrade today, take internet-facing instances off the public internet (VPN or IP allowlist) until you can. After upgrading: - Confirm the new version in the Admin area. - Review logs for repeated crashes of regex/Onigmo workers or bursts of rendering errors before the upgrade, and look for unexpected processes or files owned by the git user. If anything looks off, rotate runner tokens, deploy keys and admin tokens. Sources: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ https://securityonline.info/gitlab-critical-patch-release-cve-2026-110264/