Anyone who patched a self-managed GitLab server last week has to do it again. GitLab put out another critical release on Wednesday for CVE-2026-110264, a remote code execution flaw rated 10.0 on the CVSS scale that an attacker can reach without logging in.
The fixed builds are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, listed in the company’s patch release notes. On the 19.2, 19.3 and 19.4 branches, they sit one step past the builds GitLab shipped on Oct. 12 to close CVE-2026-97229, an earlier 10.0-rated integer overflow in its CI/CD regex compiler that Rapid7 published a proof-of-concept for the next day. This one reaches much further back. Every Community and Enterprise Edition release since 7.0, which came out in June 2014, is affected, and GitLab credited joaxcar, the same HackerOne researcher behind the Oct. 12 bug. GitLab.com already runs the fix, and Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later have nothing to do.
The flaw lives in Ruby’s regex engine
Onigmo, the regular expression library built into Ruby, stores the IDs of range-repeat quantifiers in a signed 16-bit field. Feed it a pattern with more than 32,767 of them and the number wraps negative, so the matcher writes out of bounds, Stephan Kaag explained in a Ruby bug report. Security intelligence firm Mallory traced one attack path through GitLab’s Org-mode renderer, where the org-ruby gem passes a TODO keyword chosen by the attacker into Regexp.new. GitLab’s two new detection rules look for Onigmo worker crashes and bursts of Org-mode render errors.
Ruby’s maintainers merged a fix back in April as pull request 16801, but only on the master branch, the line that becomes Ruby 4.1. GitLab worked around that by patching the copies of Ruby 3.3, 3.4 and 4.0 it bundles. Ruby 4.0.8, released Thursday, still doesn’t include the change, Kaag wrote. Jean Boussier answered on the tracker that the 3.4 branch “was backported a few hours ago,” opened a backport pull request for 4.0, and marked 3.3 as still required.
A spreadsheet library already moved
Ruby apps that build regexes from untrusted input are exposed to the same bug on an unpatched Ruby. Roo, a Ruby gem for reading spreadsheets, released version 4.0.0 on Thursday with a fix that stops turning a worksheet path from inside the file into a regex. The GitHub issue behind it warned that “any app that opens untrusted .xlsx uploads with roo, on an unpatched Ruby, can be attacked by a user who only needs to be able to upload a spreadsheet.”
Threat-detection firm SOC Prime, in a warning quoted by The Register, said GitLab repositories “frequently contain source code, CI/CD configuration, deployment secrets, access tokens, infrastructure definitions, and connections to production environments.”
No attacks have been reported so far. Mallory listed no public exploit code and no exploitation in the wild. Its tracker had logged 41 mentions of the CVE on Wednesday and 80 by Thursday afternoon.