If you run GitLab on your own servers, update it now. GitLab's patch release, dated October 21, fixes CVE-2026-110264, a flaw that lets an unauthenticated user run arbitrary code on the server. GitLab says to upgrade self-managed instances "immediately".
What the flaw is
The bug is an integer overflow in GitLab's regex compiler. It scores 10.0 on the CVSS scale, the maximum. In plain terms, someone with no account could make your server run code of their choosing.
It affects GitLab Community Edition and Enterprise Edition from version 7.0 onward. GitLab credits the report to a researcher named joaxcar, who sent it through HackerOne.
Who needs to act
- Self-managed GitLab (CE or EE): upgrade.
- GitLab.com: already patched, nothing to do.
- GitLab Dedicated: no action if you are on 19.3.5-internal0 or 19.4.2-internal0 or later.
What to do today
- Check which GitLab version you run.
- Upgrade to the fixed release for your branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
- Look for the two detections GitLab published: "Onigmo native worker crash" and "Org mode render error burst".
Why it matters
A single-node instance goes down while the upgrade runs, because of database migrations. Plan a maintenance window instead of waiting for one.
The same release fixes 11 more CVEs. One is a High-severity (8.2) LDAP account takeover, CVE-2026-15723, which applies when OmniAuth SAML and LDAP auto-linking are both enabled. If you use that setup, the upgrade closes two holes at once.
Related reading: Plex Media Server security update and WordPress site checks.
