GitLab's second 10-out-of-10 flaw this month hits every version since 2014

GitLab patched CVE-2026-110264 on October 21, an integer overflow in the Onigmo regular-expression engine that could let an unauthenticated attacker run code on a self-managed server. It is the second maximum-severity flaw in the same engine this month, and the first to reach versions before 19.2 — every release back to GitLab 7.0 from 2014 is affected.

The fix landed in seven versions at once, with backports to branches GitLab normally never patches, a measure of how serious it is. GitLab reports no sign the flaw has been exploited, and only self-managed servers need to act; GitLab.com already runs the fix. The same researcher, joaxcar, has now reported four code-execution flaws in GitLab's regex engine in a month.