CVE-2026-110264

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 7.0 through 18.11.12 GitLab CE/EE versions 19.0 through 19.0.9 GitLab CE/EE versions 19.1 through 19.1.8 GitLab CE/EE versions 19.2 through 19.2.8 GitLab CE/EE versions 19.3 through 19.3.5 GitLab CE/EE versions 19.4 through 19.4.2 GitLab CE/EE versions 19.5 through 19.5.0

Description An integer overflow exists in the regular expression compiler of the onigmo Ruby regex engine used by GitLab. This issue allows an unauthenticated user to execute arbitrary code on self-managed GitLab servers by compiling a specially crafted regular expression. Successful exploitation can enable attackers to harvest CI/CD tokens and pivot into build pipelines and internal infrastructure.

Recommendations Update GitLab CE/EE to version 18.11.13. Update GitLab CE/EE to version 19.0.10. Update GitLab CE/EE to version 19.1.9. Update GitLab CE/EE to version 19.2.9. Update GitLab CE/EE to version 19.3.6. Update GitLab CE/EE to version 19.4.3. Update GitLab CE/EE to version 19.5.1.