GitLab Integer Overflow RCE Affects All Self-Managed Releases Since 2014

All self-managed installations from version 7.0, released in 2014, through 19.5 are affected. GitLab lists the specific upgrade paths: 19.5 before 19.5.1, 19.4 before 19.4.3, 19.3 before 19.3.6, 19.2 before 19.2.9, 19.1 before 19.1.9, 19.0 before 19.0.10, and 7.0 through 18.11 before 18.11.13. The patch is available in 19.5.1 and the backported releases 18.11.13, 19.0.10, 19.1.9, and 19.2.9.

The vulnerability is an integer overflow in the Onigmo regular-expression compiler that GitLab ships in its own packages. When a specially crafted regex is compiled, the overflow can lead to arbitrary code execution on the server. GitLab does not disclose the exact conditions required for exploitation, but the flaw is rated CVSS 10.0.

The flaw allows unauthenticated users to run code on the server. No public exploitation has been reported, and the vulnerability is not listed in the U.S. CISA catalog of known exploited vulnerabilities as of October 22. However, the high CVSS score and the lack of known mitigations in older releases mean that any exposed self-managed instance could be targeted.

Only self-managed installations need to update. GitLab.com and Dedicated tenants on internal releases 19.3.5-internal0 and 19.4.2-internal0 are already on patched versions. Administrators of self-managed servers should verify their current version and apply the appropriate patch.

1. Upgrade to the latest patched release: 19.5.1 or later, or the backported releases 18.11.13, 19.0.10, 19.1.9, or 19.2.9.
2. Deploy the detection rules GitLab released: "Onigmo native worker crash" and "Org mode render error burst". These rules help identify exploitation attempts in logs.
3. Verify that the Onigmo engine is the patched version shipped with the updated GitLab package.

GitLab includes Ruby’s Onigmo engine in its own packages and applies its own patches. The same engine version is present in every release since 7.0, so the vulnerability propagates across all those versions until the fix is backported.

GitLab released the fix on October 21, 2026. An earlier update on October 12 covered only versions 19.2 and later, leaving many installations in the vulnerable range. The new patch sits one release above the October 12 update, so an instance updated then is again exposed until it receives the latest fix.

The CVSS score of 10.0 places this flaw among the most severe. Similar high-impact RCEs, such as the Bricksforge exploit, also target unauthenticated users and require specific conditions. The lack of public exploitation data suggests the vulnerability is either not yet leveraged or is actively mitigated by the community.

After applying the patch, enable the provided detection rules to watch for anomalous regex compilation failures or worker crashes. Monitor system logs for patterns matching the rule signatures. If any suspicious activity is detected, investigate immediately for potential exploitation attempts.

GitLab Dedicated tenants on internal releases 19.3.5-internal0 and 19.4.2-internal0 are already patched. GitLab.com is unaffected. No other GitLab-related services are mentioned as impacted.

Verify the current GitLab version, compare it against the upgrade matrix, and apply the appropriate patch immediately. After updating, enable the detection rules and review logs for any signs of exploitation. If the environment is critical, consider additional network segmentation or firewall rules to limit exposure until the patch is fully validated.