An integer overflow in GitLab's regular expression compiler lets an unauthenticated attacker run code on self-managed GitLab CE and EE servers, affecting every release from 7.0 onward. Fixes: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. GitLab published two detection rules; no exploitation was confirmed at disclosure.
What to do: Upgrade to the fixed releases; prioritize internet-facing instances and run GitLab's detection rules. Oct 24: Ruby 4.0.9, 3.4.12 and 3.3.13 fix three Onigmo regex engine bugs (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229) that are the root of the critical GitLab RCE flaws including CVE-2026-110264. Any Ruby app that compiles attacker-supplied regex is exposed. No confirmed exploitation.
GitLab just patched a CVSS 10.0 flaw that hits 12 years of releases.
Attackers can exploit a critical vulnerability in GitLab to execute arbitrary code without authentication. Patch immediately. 🔗: https://t.co/kStC2osJ8D https://t.co/1RmhrfyQNv
#CyberAlerts | Multiple security advisories: Oracle Corporation, ISC BIND, Cisco, GitLab, Roundcube. We encourage users and administrators to review and apply the necessary updates. For more information: https://t.co/W
And the security shitshow continues... Four more things to add to yesterday's list. We're now at nine(!) major security issues and developments in just a few days. 6. ISC BIND 9 - Multiple Vulnerabilities Four new vuln
CERT-In has published Vulnerability Notes on its website. Multiple Vulnerabilities in F5 Products https://t.co/aJKq0cD8el Multiple Vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) https://t
‼️ FOUR critical GitLab RCE flaws traced back to just THREE bugs in Ruby's regex engine. Ruby has now fixed them, but this isn't just a GitLab issue. Other Ruby apps that compile attacker-controlled regex patterns are also affected. Details ➜
Why this score
Hundreds of thousands of self-managed instances (impact 3), no confirmed exploitation yet (exploitability 1), general sector (criticality 0), plus maximum CVSS.