{"schema":"vulnpedia.research/1","cve":"CVE-2026-110264","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/633633","tags":[],"source":"mitre","sourceId":"GitLab","modified":"2026-10-22T00:33:48.179Z","origins":[{"source":"mitre","sourceId":"GitLab","modified":"2026-10-22T00:33:48.179Z","url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"},{"source":"nvd","sourceId":"CVE-2026-110264","modified":"2026-10-22T23:18:22.670","url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"}]},{"url":"https://hackerone.com/reports/4093475","tags":["technical-description","exploit","permissions-required"],"source":"mitre","sourceId":"GitLab","modified":"2026-10-22T00:33:48.179Z","origins":[{"source":"mitre","sourceId":"GitLab","modified":"2026-10-22T00:33:48.179Z","url":"https://hackerone.com/reports/4093475"},{"source":"nvd","sourceId":"CVE-2026-110264","modified":"2026-10-22T23:18:22.670","url":"https://hackerone.com/reports/4093475"}]},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","tags":[],"source":"mitre","sourceId":"GitLab","modified":"2026-10-22T00:33:48.179Z","origins":[{"source":"mitre","sourceId":"GitLab","modified":"2026-10-22T00:33:48.179Z","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"},{"source":"nvd","sourceId":"CVE-2026-110264","modified":"2026-10-22T23:18:22.670","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}]},{"source":"euvd","sourceId":"EUVD-2026-107696","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107696","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-107696","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107696"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/TahuCryptsi/gitlab-onigmo-check","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"Local detector for CVE-2026-110264 (GitLab Onigmo regex repeat-ID overflow, CVSS 10.0 unauth RCE). One-file Ruby check + real crash transcript.","modified":"2026-10-22T16:11:00Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/TahuCryptsi/gitlab-onigmo-check"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-22T16:11:00Z","url":"https://github.com/TahuCryptsi/gitlab-onigmo-check"}],"tags":[]},{"url":"https://github.com/TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"CVE-2026-110264 — GitLab Unauthenticated RCE (Onigmo regex repeat-ID overflow, CVSS 10.0). Docker-verified crash PoC on ruby 3.4.11 + measured heap analysis. Crash-level, non-weaponized.","modified":"2026-10-22T16:58:12Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-22T16:58:12Z","url":"https://github.com/TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264"}],"tags":[]},{"url":"https://github.com/al4n4n/CVE-2026-110264","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.","modified":"2026-10-25T11:22:13Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/al4n4n/CVE-2026-110264"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-25T11:22:13Z","url":"https://github.com/al4n4n/CVE-2026-110264"}],"tags":[]},{"url":"https://github.com/xaviware/go-gitlab-cve-2026-110264-scanner","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"Fast, concurrent and non-intrusive exposure auditor in Go for GitLab CE/EE unauthenticated RCE (CVE-2026-110264 - CVSS 10.0)","modified":"2026-10-22T23:11:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/xaviware/go-gitlab-cve-2026-110264-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-22T23:11:50Z","url":"https://github.com/xaviware/go-gitlab-cve-2026-110264-scanner"}],"tags":[]},{"url":"https://github.com/bastet-ai/gitlab-firing-range","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"Authorized loopback-only Docker firing range for CVE-2026-110264 (Onigmo regex integer-overflow, unauth RCE) research + detection engineering","modified":"2026-10-23T21:06:12Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/bastet-ai/gitlab-firing-range"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-23T21:06:12Z","url":"https://github.com/bastet-ai/gitlab-firing-range"}],"tags":[]},{"url":"https://github.com/TheGlitchFixer/gitlab-patch-check","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"Check whether your self-hosted GitLab version is patched against CVE-2026-110264 (CVSS 10.0 RCE) — companion script for The Homelab Fixer guide.","modified":"2026-10-23T05:52:17Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/TheGlitchFixer/gitlab-patch-check"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-23T05:52:17Z","url":"https://github.com/TheGlitchFixer/gitlab-patch-check"}],"tags":[]},{"url":"https://github.com/farimazhar/GitLab2Safe-Defensive-Checker","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"100% Defensive Scanner for CVE-2026-110264 GitLab Arbitrary File Write (PHP2Shell) - No exploit code, only version & patch detection for security teams and learners.","modified":"2026-10-23T13:30:06Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/farimazhar/GitLab2Safe-Defensive-Checker"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-23T13:30:06Z","url":"https://github.com/farimazhar/GitLab2Safe-Defensive-Checker"}],"tags":[]},{"url":"https://github.com/FranklinF25/regex2shell","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"regex2shell (CVE-2026-110264 + family) — GitLab/Onigmo unauth regex RCE research: safe differential detector, deterministic interpreter kill, match-time write primitive","modified":"2026-10-25T02:50:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/FranklinF25/regex2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-25T02:50:47Z","url":"https://github.com/FranklinF25/regex2shell"}],"tags":[]},{"url":"https://github.com/lesterlam/onigmo-cve-2026-110264","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"Reproduction lab for CVE-2026-110264 - the 16-bit ID overflow in Onigmo, the regexp engine Ruby bundles (GitLab CE/EE, CVSS 10.0). Standalone engine build + A/B against the vendor fix. Trigger condition only; no weaponised exploit.","modified":"2026-10-24T00:41:13Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/lesterlam/onigmo-cve-2026-110264"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-24T00:41:13Z","url":"https://github.com/lesterlam/onigmo-cve-2026-110264"}],"tags":[]},{"url":"https://github.com/googlesky/CVE-2026-110264","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"PoC, reproducible labs, live evidence, Nuclei fingerprint, and technical report for CVE-2026-110264 — GitLab Org-mode/Onigmo unauthenticated RCE (CVSS 10.0); render oracle validated on GitLab CE 19.3.1.","modified":"2026-10-24T07:11:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/googlesky/CVE-2026-110264"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-24T07:11:31Z","url":"https://github.com/googlesky/CVE-2026-110264"}],"tags":[]},{"url":"https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE","source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-24T14:40:50Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-24T14:40:50Z","url":"https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE"}],"tags":[]},{"url":"https://github.com/emirwtz/CVE-2026-110264","source":"poc-in-github","sourceId":"CVE-2026-110264","description":"Non-invasive Python detector for CVE-2026-110264 in GitLab, featuring version checks, offline log analysis, and JSON reporting.","modified":"2026-10-24T19:10:48Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-110264","url":"https://github.com/emirwtz/CVE-2026-110264"},{"source":"poc-in-github","sourceId":"CVE-2026-110264","modified":"2026-10-24T19:10:48Z","url":"https://github.com/emirwtz/CVE-2026-110264"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[]}