A CVSS 10 in GitLab That GitLab Never Wrote

GitLab’s worst bug this year is not GitLab’s code. CVE-2026-110264 is a CVSS 10.0 an unauthenticated caller can trigger, and the overflow it rides on has been sitting in Ruby’s regex engine for years.

• GitLab shipped 19.5.1 plus 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on 21 October. Every CE and EE version from 7.0 is affected.
• Onigmo stores repeat and null-check identifiers in a signed 16-bit operand while counting them in an int. Past 32,767 of either, the identifier wraps negative and the match writes out of bounds on the repeat stack.
• The upstream fix exists only on Ruby master, meaning 4.1. GitLab carries three build-time patches for Ruby 3.3, 3.4 and 4.0 in its omnibus and container images.
• gitlab.com is patched, and recent Dedicated tenants need no action. Self-managed instances do.
• Two detection rules shipped with the release, an Onigmo native worker crash and an org mode render error burst. They show what an attempt looks like from the server side.
• The same release fixes an 8.2 OmniAuth and LDAP account takeover and a 7.5 OAuth discovery cache poisoning flaw.

A code host answers on the internet by design. Full analysis here.