GitLab released patches on October 21 for a critical security flaw that scored a perfect 10.0 on the CVSS scale. According to the company, the bug could let an unauthenticated attacker run harmful code on any self-managed GitLab server.
The flaw sits in Onigmo, a regex engine that Ruby uses and GitLab ships in its own packages. Specifically, an integer overflow during regex compilation triggers the issue. As a result, a crafted regular expression can give attackers full control of the server.
GitLab patched seven versions at once, from 18.11.13 all the way to 19.5.1. In addition, four of those patches fall outside the company’s normal support window. Indeed, GitLab typically reserves such wide backports for the most severe bugs only.
This marks the fourth code-execution flaw in GitLab’s regex engine in about a month. A researcher using the handle “joaxcar” discovered all four bugs. The same researcher also found CVE-2026-97229, another CVSS 10.0 flaw that GitLab patched on October 12. However, GitLab has not shared the exact conditions needed to exploit the flaw, so administrators cannot rule themselves out by changing settings.
GitLab.com already runs the fixed version, and GitLab Dedicated tenants also have the patch. Only self-managed installations remain at risk. Furthermore, no workaround exists, so patching is the only protection.
The company also fixed 10 other security issues in the same release. For instance, CVE-2026-15723 (CVSS 8.2) could let a logged-in user take over another account on servers with both SAML and LDAP auto-linking turned on. Meanwhile, CVE-2026-112212 (CVSS 7.5) involves a cache-poisoning flaw in OAuth and OpenID Connect sign-in flows.
GitLab reports no evidence of real-world attacks so far. In addition, the flaw does not appear in CISA’s Known Exploited Vulnerabilities catalog as of October 22. Still, GitLab published two detection rules in its open-source TLDR framework so administrators can check their logs for signs of attempted exploits.
