{"id":"CVE-2026-110264","published":"2026-10-22T01:16:57Z","modified":"2026-10-31T00:16:51Z","title":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10…","vendor":"GitLab","product":"GitLab","tier":"core","eol":null,"description":{"text":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","provenance":"source","from":"NVD"},"summary":{"text":"GitLab CE/EE contains an integer overflow flaw (CWE: Integer Overflow or Wraparound) in how the product compiles regular expressions. An attacker can exploit it by submitting a specially crafted regular expression over the network without authentication, and under certain conditions this can lead to arbitrary code execution on the GitLab server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:15Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01305,"percentile":0.7051,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae20c290cecfbc79bd84822","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae0ba8e2d29f6aa1bfe6f11","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6adf68c4585d98c8d3af5bea","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adb7421f0eaee440740fbf3","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ada23844cb3f14c39a33102","created":"2026-10-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/633633","tags":["Permissions Required"]},{"url":"https://hackerone.com/reports/4093475","tags":["Permissions Required"]},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-107696","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107696","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":1,"earliest":"2026-10-22","earliestUrl":"https://github.com/TahuCryptsi/gitlab-onigmo-check","repos":[{"name":"al4n4n/CVE-2026-110264","url":"https://github.com/al4n4n/CVE-2026-110264","stars":2,"created":"2026-10-22"},{"name":"TahuCryptsi/gitlab-onigmo-check","url":"https://github.com/TahuCryptsi/gitlab-onigmo-check","stars":0,"created":"2026-10-22"},{"name":"TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264","url":"https://github.com/TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264","stars":0,"created":"2026-10-22"},{"name":"xaviware/go-gitlab-cve-2026-110264-scanner","url":"https://github.com/xaviware/go-gitlab-cve-2026-110264-scanner","stars":0,"created":"2026-10-22"},{"name":"bastet-ai/gitlab-firing-range","url":"https://github.com/bastet-ai/gitlab-firing-range","stars":0,"created":"2026-10-23"}]},"first":{"date":"2026-10-22","source":"PoC-in-GitHub","url":"https://github.com/TahuCryptsi/gitlab-onigmo-check"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","provenance":"source"},{"date":"2026-10-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/TahuCryptsi/gitlab-onigmo-check","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":28.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.1,"detail":"percentile 0.7051"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"11 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}