---
id: CVE-2026-110264
title: Integer Overflow or Wraparound in GitLab
summary: >-
  An issue has been discovered in GitLab CE/EE affecting all versions from 7.0
  before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9,
  19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under
  certain…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-190
vendor: GitLab
product: GitLab
affected:
  - GitLab >= 7.0 < 18.11.13
  - GitLab >= 19.0 < 19.0.10
  - GitLab >= 19.1 < 19.1.9
  - GitLab >= 19.2 < 19.2.9
  - GitLab >= 19.3 < 19.3.6
  - GitLab >= 19.4 < 19.4.3
  - GitLab >= 19.5 < 19.5.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-22T12:50:08.716294Z'
exploitAvailable: true
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T23:05:04.898Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110264'
references:
  - url: 'https://gitlab.com/gitlab-org/gitlab/-/work_items/633633'
  - url: 'https://hackerone.com/reports/4093475'
    label: 'HackerOne Bug Bounty Report #4093475'
  - url: >-
      https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
tags:
  - cve.org
  - exploit-available
epss: 0.00505
epssPercentile: 0.42235
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/TahuCryptsi/gitlab-onigmo-check'
    - 'https://github.com/TahuCryptsi/poc-gitlab-onigmo-cve-2026-110264'
  checkedAt: '2026-10-23T00:10:45.337Z'
ingestedAt: '2026-10-22T01:22:20.405Z'
---

## Overview

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

## Affected

- `GitLab >= 7.0 < 18.11.13`
- `GitLab >= 19.0 < 19.0.10`
- `GitLab >= 19.1 < 19.1.9`
- `GitLab >= 19.2 < 19.2.9`
- `GitLab >= 19.3 < 19.3.6`
- `GitLab >= 19.4 < 19.4.3`
- `GitLab >= 19.5 < 19.5.1`

## Remediation

Upgrade to versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1, or later.