GitLab said it released GitLab Community Edition and Enterprise Edition 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on 21 October 2026 and strongly recommends that all self-managed installations upgrade immediately.

GitLab says the critical flaw, CVE-2026-110264, could under certain conditions have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to an integer overflow when compiling a specially crafted regular expression; it rates it CVSS 3.1 10.0 and lists all CE/EE versions from 7.0 as affected up to the fixed releases.

GitLab says it backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 in addition to its standard patch releases, that GitLab.com is already running the patched version, and that GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes. GitLab has released two threat detections for self-managed customers, 'Onigmo native worker crash' and 'Org mode render error burst'.

Researcher joaxcar reported the flaw through GitLab's HackerOne bug bounty programme. GitLab's release also fixes 11 further security issues rated high, medium or low, including an account takeover flaw when OmniAuth SAML and LDAP auto-linking are both enabled (CVE-2026-15723, CVSS 8.2) and an OAuth/OIDC discovery cache-poisoning flaw (CVE-2026-112212, CVSS 7.5).

GitLab says the patch includes database migrations, so single-node instances will have downtime during the upgrade, while multi-node instances can apply it without downtime using zero-downtime upgrade procedures.

According to The Hacker News, GitLab's 12 October fix for the earlier regex-compiler flaw CVE-2026-97229 covered only 19.2 and later, so an instance updated then is in range again, and GitLab's advisory offers no interim workaround.

Primary: GitLab Critical Patch Release 19.5.1 (21 Oct); wire: The Hacker News (21 Oct).

UPDATE (24 Oct 2026): Ruby said on 23 October (03:11 UTC) that it has released Ruby 4.0.9, 3.4.12 and 3.3.13, which fix the bugs in Ruby's regular expression engine (Onigmo) behind GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264.

Ruby says the fix for the bug behind CVE-2026-110264 (overflow of internal IDs in a pattern with many repeats) first ships in 4.0.9, so Ruby 4.0.8 does not contain it, while 3.4.12 and 3.3.13 contain all the fixes.

Ruby says an application is affected only if it compiles a regular expression from a string an attacker controls, for example by passing it to Regexp.new, Regexp.union or Regexp.compile or interpolating it into a regexp literal such as /#{input}/; applications that only use regular expressions written by their own developers are not affected.

Ruby says Regexp.timeout does not protect against these bugs and that limiting pattern length is not reliable because some can be triggered by short patterns. Ruby has not requested CVE identifiers of its own 'at least for now' and asks users to track the issues by GitLab's CVE numbers, for example in a security scanner. (source: Ruby)