CVE-2026-110264

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 7.0 through 18.11.13 GitLab CE/EE versions 19.0 through 19.0.10 GitLab CE/EE versions 19.1 through 19.1.9 GitLab CE/EE versions 19.2 through 19.2.9 GitLab CE/EE versions 19.3 through 19.3.6 GitLab CE/EE versions 19.4 through 19.4.3 GitLab CE/EE versions 19.5 through 19.5.1

Description An integer overflow exists in the Onigmo regular expression engine used by GitLab when processing Org mode files with the .org extension. This issue occurs when the org-ruby library processes user-defined keywords such as #+TODO:, #+SEQ TODO:, or #+TYP TODO: containing a regular expression with more than 32,767 repeats. An unauthenticated remote attacker can exploit this by uploading a specially crafted file to a public project; the vulnerability is triggered when the file's preview page is opened. This can lead to memory corruption and arbitrary code execution on the server, potentially granting access to source code, access tokens, and credentials. Over 10,000 vulnerable instances are estimated to be exposed to the internet.

Recommendations Update to versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. For installations using custom Ruby versions or custom container images, update Ruby to version 3.3.13, 3.4.12, 4.0.9, or later. Deploy the official detection rules Onigmo native worker crash and Org mode render error burst. Restrict network access to the GitLab instance via VPN or whitelist if public availability is not required. Configure WAF/IDS to detect abnormally long, repeating constructions within #+TODO:, #+SEQ TODO:, or #+TYP TODO: strings in .org files.