GitLab Update: Patch the CVSS-10 RCE Tonight — Self-Hosted Fix Guide (CVE-2026-110264)

On October 21, 2026, GitLab shipped a critical patch release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for Community and Enterprise Edition. The headline fix is CVE-2026-110264 — an integer overflow in the regex compiler that, in GitLab's own words, "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server." Severity: Critical, CVSS 10.0. Every self-hosted GitLab from version 7.0 onward is exposed unless it's on a fixed build.

This is the operator's version of the story: which build your line needs, how to back up first, the Docker and Omnibus upgrade path, the migration-downtime trap on 19.4.x, and what to do if you can't patch tonight. Same patch-tonight discipline as our php2shell emergency RCE playbook — different stack, same urgency.

⚠️ Honest testing note. We did not reproduce an exploit in a lab — deliberately. Every fact below is quoted or derived from GitLab's official patch release page and standard documented upgrade procedures. Commands are the documented forms; adapt hostnames, container names, and paths to your setup.

What CVE-2026-110264 Actually Is

Strip the CVE-speak and the bug is this: GitLab compiles regular expressions with the Onigmo engine, and a specially crafted regex could trigger an integer overflow during compilation — handing an attacker who never logged in a path to remote code execution on your server. The CVSS vector says it all: network attack, low complexity, no privileges, no user interaction, full impact on confidentiality, integrity, and availability. Reported by joaxcar through HackerOne's bug bounty program.

Two things make this worse than a normal critical patch: the version range is enormous — every self-hosted GitLab from version 7.0 onward that hasn't patched is exposed, including the classic homelab "it just works" box; and the patch carries database migrations. GitLab warns: "This patch includes database migrations that may impact your upgrade process." On single-node installs — nearly every homelab — "this patch will cause downtime during the upgrade as migrations must complete before GitLab can start." Patching is not a 30-second restart this time. Plan for it. Running other self-hosted services? The same patch-tonight discipline applies to media servers — see our Plex Media Server update guide for the Plex2Shell RCE (CVE-2026-96652).

Step 0: Are You Vulnerable? (60-Second Check)

Get your exact version first — two reliable ways:

# Omnibus install
sudo gitlab-rake gitlab:env:info | grep -i "gitlab version"

# Docker install
docker exec gitlab gitlab-rake gitlab:env:info | grep -i "gitlab version"

Or open your instance's Help page (https://your-gitlab/help) — the version is printed at the top. Then match it against your line's fixed build:

Your line	Patch to (fixed)
19.5.x	19.5.1
19.4.x	19.4.3
19.3.x	19.3.6
19.2.x	19.2.9
19.1.x	19.1.9
19.0.x	19.0.10
18.11.x or older	18.11.13 (then plan the multi-stop upgrade below)

Anything below its line's fixed build is exposed — including instances upgraded earlier this month. Search interest is currently spiking for specific versions like 19.4.2: if that is you, you are exactly one patch behind the fix.

✅ The rule: stay on your current minor line and take its patch build. Do not jump minor versions in the same move — GitLab's upgrade path rules still apply, and skipping lines is how upgrades break.

Step 1: Back Up Before You Touch Anything

Migrations plus a security patch is the highest-risk upgrade combination. Back up before upgrading, with the snapshot-first discipline from our SafePay NAS survival guide:

# Omnibus — the documented backup task (standard procedure)
sudo gitlab-backup-cli backup create

# Docker — run the backup inside the container, then copy it off the host
docker exec -t gitlab gitlab-backup-cli backup create
docker cp gitlab:/var/opt/gitlab/backups/ /safe/place/off/the/host/

Also snapshot the VM or the Docker volumes if you can. Verify the backup file actually exists and has a sane size before proceeding — an untested backup is a rumor, not a backup.

Step 2: Upgrade — Docker

Most homelabs run GitLab in Docker. The procedure is pull, stop, remove, recreate — with one critical detail:

# Pull the EXACT fixed tag for your line (example: 19.5.x line)
docker pull gitlab/gitlab-ce:19.5.1-ce.0

# Stop and remove the old container (data lives in volumes, not the container)
docker stop gitlab
docker rm gitlab

# Recreate with your ORIGINAL run flags — same volumes, same ports, same hostname
docker run --detach \
  --hostname gitlab.example.com \
  --publish 443:443 --publish 80:80 \
  --name gitlab \
  --restart always \
  --volume /srv/gitlab/config:/etc/gitlab \
  --volume /srv/gitlab/logs:/var/log/gitlab \
  --volume /srv/gitlab/data:/var/opt/gitlab \
  gitlab/gitlab-ce:19.5.1-ce.0

Three homelab-specific warnings: pin the tag, not :latest — :latest can pull a new minor line and break your upgrade path. Watchtower users: exclude GitLab or pin it — an unattended major-version jump on a database-backed app is how instances get stranded (same upgrade discipline as our n8n 3.0 breaking-changes guide). And expect a long first start — the container runs migrations before the web UI responds, so don't restart it mid-migration.

Step 3: Upgrade — Omnibus (apt/yum)

Bare-metal and VM installs use the package manager. Pin the version so you land on the fixed build, not whatever is newest:

# Debian/Ubuntu — install the exact fixed build for your line
sudo apt update
sudo apt install gitlab-ce=19.5.1-ce.0

# Then reconfigure (standard procedure — applies the new version)
sudo gitlab-ctl reconfigure

On RHEL-family systems the equivalent is sudo yum install gitlab-ce-19.5.1-ce.0 (or dnf), then the same reconfigure. The reconfigure runs the migrations — on a single-node box, GitLab stays down until they finish. That is expected and documented, not a failure.

Step 4: Upgrade — Helm (Kubernetes)

Helm-chart installs: upgrade to the chart version that maps to your line's fixed app build (helm upgrade with the target chart version from GitLab's Helm chart release notes). Same migration caveat applies — watch the migration jobs complete before declaring victory. One paragraph is all this path needs; the chart's own upgrade notes are the authority here.

Step 5: Verify — Don't Trust the Banner

After the upgrade, verify properly — GitLab's in-app "update available" banner is a lagging indicator:

1. Re-run the version check from Step 0 — you should see your line's fixed build.
2. Open Admin > Monitoring > Background Migrations and confirm every migration shows finished. On 19.4.x there are both regular and post-deploy migrations — the instance isn't fully patched until both are done.
3. Check the logs for Onigmo-related crashes around the upgrade window. GitLab's published detections — "Onigmo native worker crash" and "Org mode render error burst" — double as a post-upgrade sanity signal.

Older than 18.11? You can't jump straight to a fixed build — GitLab requires stepping through intermediate versions, so this becomes a planned maintenance window, not a tonight task. Start it now, and apply the deferred-upgrade hardening above in the meantime.

Can't Patch Tonight? Reduce Exposure Now

If the upgrade has to wait for a maintenance window, shrink the attack surface: take GitLab off the public internet (Tailscale/WireGuard or IP allowlist — an unauthenticated RCE can't reach what it can't route to); restrict public projects and open sign-ups; deploy GitLab's detection rules ("Onigmo native worker crash", "Org mode render error burst"); and if you suspect compromise, rotate secrets — CI/CD variables, runner tokens, deploy keys — then patch, then rotate again.

None of this replaces the patch. GitLab's recommendation is unambiguous: upgrade affected installations "as soon as possible." The hardening buys you a safer window, not a pass.

FAQ

What is CVE-2026-110264?

An integer overflow in GitLab's Onigmo regular expression compiler that could let an unauthenticated attacker execute arbitrary code on the GitLab server. Rated Critical, CVSS 10.0, reported by joaxcar via HackerOne, and fixed in GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 (released October 21, 2026).

Am I affected if I run GitLab in Docker?

Yes — when no specific deployment type is mentioned in GitLab's advisory, all types are affected, including Docker, Omnibus, source, and Helm installs. Check your version with docker exec gitlab gitlab-rake gitlab:env:info and compare against your line's fixed build.

Will the upgrade cause downtime?

On single-node installs, yes — GitLab states the patch "will cause downtime during the upgrade as migrations must complete before GitLab can start," particularly on the 19.4.x and 19.3.x lines which include regular and post-deploy migrations. Multi-node installs can use zero-downtime procedures. Schedule accordingly.

I upgraded GitLab earlier this month. Am I safe?

Only if your build is at or above your line's fixed version (19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13). Anything below those lines — including builds from earlier in October — is still exposed to CVE-2026-110264. Re-check your exact version; don't assume.

Should I use :latest for the Docker image?

No. Pin the exact fixed tag for your line (e.g. gitlab/gitlab-ce:19.5.1-ce.0) — :latest can pull a new minor version and break GitLab's upgrade path. If you use Watchtower, exclude GitLab or pin it.

How do I know the patch actually applied?

Re-run the version check, then go to Admin > Monitoring > Background Migrations and confirm all migrations show finished — don't rely on the in-app update banner. On 19.4.x, verify both regular and post-deploy migrations completed.

One more runtime to check before you sleep: if Node.js runs anywhere in your stack, walk through the Node2Shell patch runbook — the same patch-tonight discipline, applied to every container hiding a Node runtime.