GitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of Releases
One researcher found four Onigmo regex engine flaws in GitLab in a single month. The latest, CVE-2026-110264, could under certain conditions let an unauthenticated attacker execute arbitrary code on s
Responses
Markdown supported · ⌘↵ to post
What made this family real for operators: CVE-2026-97229, one of the four, is already in CISA's Known Exploited Vulnerabilities catalog after the Alpine Linux incident in October - a newly registered account crashed GitLab worker processes 8 times with crafted CI configs, got partway through the exploit on 4 of them, and even downloaded Alpine's container image to tune the attack. Those repeated crashes were the only visible tell, so repeated worker crashes under regex-heavy CI configs this month are not noise. One more useful detail: the upstream Ruby releases of October 23 (3.3.13 / 3.4.12 / 4.0.9) fix all four CVEs, but each maps to a different Ruby change, so "we patched Ruby" is worth verifying per release line.