CVE-2026-110264
CRITICAL 10An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Severe if exploited (CVSS 10), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
1.0%chance of exploitation in 30 days · 63rd percentile
Impact if exploited
10CVSS 3.1 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-190: : Integer Overflow or Wraparound
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
12 candidates
- https://github.com/TahuCryptsi/gitlab-onigmo-check
Local detector for CVE-2026-110264 (GitLab Onigmo regex repeat-ID overflow, CVSS 10.0 unauth RCE). One-file Ruby check + real crash transcript.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-22T16:11:00Z - https://github.com/TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264
CVE-2026-110264 — GitLab Unauthenticated RCE (Onigmo regex repeat-ID overflow, CVSS 10.0). Docker-verified crash PoC on ruby 3.4.11 + measured heap analysis. Crash-level, non-weaponized.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-22T16:58:12Z - https://github.com/al4n4n/CVE-2026-110264
CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-25T11:22:13Z - https://github.com/xaviware/go-gitlab-cve-2026-110264-scanner
Fast, concurrent and non-intrusive exposure auditor in Go for GitLab CE/EE unauthenticated RCE (CVE-2026-110264 - CVSS 10.0)
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-22T23:11:50Z - https://github.com/bastet-ai/gitlab-firing-range
Authorized loopback-only Docker firing range for CVE-2026-110264 (Onigmo regex integer-overflow, unauth RCE) research + detection engineering
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-23T21:06:12Z - https://github.com/TheGlitchFixer/gitlab-patch-check
Check whether your self-hosted GitLab version is patched against CVE-2026-110264 (CVSS 10.0 RCE) — companion script for The Homelab Fixer guide.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-23T05:52:17Z - https://github.com/farimazhar/GitLab2Safe-Defensive-Checker
100% Defensive Scanner for CVE-2026-110264 GitLab Arbitrary File Write (PHP2Shell) - No exploit code, only version & patch detection for security teams and learners.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-23T13:30:06Z - https://github.com/FranklinF25/regex2shell
regex2shell (CVE-2026-110264 + family) — GitLab/Onigmo unauth regex RCE research: safe differential detector, deterministic interpreter kill, match-time write primitive
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-25T02:50:47Z - https://github.com/lesterlam/onigmo-cve-2026-110264
Reproduction lab for CVE-2026-110264 - the 16-bit ID overflow in Onigmo, the regexp engine Ruby bundles (GitLab CE/EE, CVSS 10.0). Standalone engine build + A/B against the vendor fix. Trigger condition only; no weaponised exploit.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-24T00:41:13Z - https://github.com/googlesky/CVE-2026-110264
PoC, reproducible labs, live evidence, Nuclei fingerprint, and technical report for CVE-2026-110264 — GitLab Org-mode/Onigmo unauthenticated RCE (CVSS 10.0); render oracle validated on GitLab CE 19.3.1.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-24T07:11:31Z - https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCEPoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-24T14:40:50Z - https://github.com/emirwtz/CVE-2026-110264
Non-invasive Python detector for CVE-2026-110264 in GitLab, featuring version checks, offline log analysis, and JSON reporting.
PoC-in-GitHub · CVE-2026-110264
PoC-in-GitHub · CVE-2026-110264 · Updated 2026-10-24T19:10:48Z
All CVSS metrics
- CRITICAL 10 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CRITICAL 10 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://hackerone.com/reports/4093475 CVE record · GitLab · Updated 2026-10-22T00:33:48.179Z
NVD · CVE-2026-110264 · Updated 2026-10-22T23:18:22.670
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107696 EUVD · EUVD-2026-107696
Technical & other
- https://gitlab.com/gitlab-org/gitlab/-/work_items/633633CVE record · GitLab · Updated 2026-10-22T00:33:48.179Z
NVD · CVE-2026-110264 · Updated 2026-10-22T23:18:22.670 - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/CVE record · GitLab · Updated 2026-10-22T00:33:48.179Z
NVD · CVE-2026-110264 · Updated 2026-10-22T23:18:22.670