GitLab shipped an emergency patch on 21 October for a flaw that scores the maximum possible severity: CVSS 10.0. Tracked as CVE-2026-110264, it lives in Onigmo, the regular-expression engine GitLab bundles inside Community Edition and Enterprise Edition. An integer overflow during regex compilation lets an unauthenticated attacker corrupt memory and run arbitrary code on the server — no password, no account, no click required. The flaw has been present since GitLab 7.0 in 2014, meaning essentially every self-managed release of the last twelve years was affected until this week's fix.
Two details matter beyond the headline number. First, this is a separate bug from CVE-2026-97229, a different critical regex RCE GitLab patched on 12 October — so if your team applied that earlier fix and stopped there, you are not protected against this one. Second, this only affects self-managed GitLab installations; GitLab.com and GitLab Dedicated (the vendor-hosted options) were already carrying the fix before it was publicly disclosed. The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab reports no confirmed exploitation in the wild so far — the flaw was responsibly disclosed by an independent researcher through HackerOne — but security researchers at Shadowserver have already counted more than 2,700 unpatched self-managed instances reachable from the open internet, so the window to act quietly is short.
What this means for your business
The question to ask this week isn't "do we use GitLab" — it's "which GitLab." If your development team or agency uses GitLab.com (the hosted SaaS version) for source control, you're already covered and there's nothing to do. If anyone on your team runs a self-hosted GitLab instance — on your own server, a VPS, or an internal network — that's the system that needs attention: check the version against the fixed list above, and if it's not there, upgrade now. There is no workaround or configuration change that closes this gap short of upgrading.
If your developers or outsourced dev team patched GitLab on or around 12 October and assumed they were done for the month, double-check: that was a different vulnerability, and this one needs its own update. A self-hosted code repository is the kind of system that often falls outside routine maintenance schedules because "it just runs" — this is a good prompt to confirm someone actually owns patching it, not just the public-facing website.