GitLab has issued a critical patch release affecting multiple versions of its Community Edition (CE) and Enterprise Edition (EE) software. The update addresses a high-severity vulnerability (CVE-2026-110264) where an integer overflow in the regular expression compiler could allow an unauthenticated user to execute arbitrary code on the GitLab server. This flaw was discovered and reported through the HackerOne bug bounty program. To mitigate this risk, GitLab strongly recommends that all self-managed installations upgrade to the patched versions immediately, which include 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
This image represents the GitLab platform which is the subject of the critical security patches and vulnerability disclosures.
Beyond the critical remote code execution flaw, the patch release addresses several other significant security issues. These include a high-severity improper authentication issue in OmniAuth-to-LDAP auto-linking (CVE-2026-15723), which could allow an authenticated user to take over an LDAP-backed account. Other addressed vulnerabilities range from medium to low severity, such as cache poisoning in OAuth/OIDC discovery endpoints, improper access control in GraphQL fields, and internal credential exposure in response headers. While GitLab.com and GitLab Dedicated tenants running specific internal versions are already patched, self-managed users must manually apply these updates to maintain security hygiene.
To assist administrators in identifying and mitigating these risks, GitLab has released two specific threat detections for self-managed instances: an 'Onigmo native worker crash' and an 'Org mode render error burst.' These detections are designed to help users identify potential exploitation attempts in their logs. GitLab notes that while they are committed to high security standards, the discovery of these vulnerabilities—some of which were identified internally or via bug bounties—highlights the ongoing need for proactive patching. The company maintains a policy of making the specific details of these vulnerabilities public on their issue tracker 90 days after the patch release to provide further transparency and technical context for affected users.