{"slug":"gitlab-onigmo-rce","title":"GitLab unauthenticated RCE (CVE-2026-110264)","shortName":"GitLab RCE","summary":"Unauthenticated remote code execution on self-managed GitLab CE/EE from an integer overflow in the regular expression compiler GitLab uses (Ruby's Onigmo). CVE-2026-110264 is CVSS 10.0, affecting versions from 7.0, fixed 21 Oct 2026. Related CVE-2026-97229 (also CVSS 10.0) was fixed 12 Oct 2026; those builds still need the 21 Oct release. Not in CISA KEV. No in-the-wild exploitation reported.","isExample":false,"draft":false,"family":"gitlab-onigmo-rce","kind":"single-product","aliases":["CVE-2026-110264","CVE-2026-97229","GitLab unauthenticated RCE","Onigmo RCE"],"publishedAt":"2026-10-24","updatedAt":"2026-10-24","patchStatus":"patched","exploited":false,"scores":{"cve":"CVE-2026-110264","cvss":{"cve":"CVE-2026-110264","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","sourceDate":"2026-10-22","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2026-110264","score":0.00505,"percentile":0.423,"date":"2026-10-24","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-110264","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2026-110264","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"high"},"managementSummary":{"what":"Unauthenticated remote code execution on self-managed GitLab CE/EE from an integer overflow in the regular expression compiler (CVE-2026-110264, CVSS 10.0). Related CVE-2026-97229 is a separate overflow fixed 12 Oct 2026. Not in CISA KEV. No in-the-wild exploitation reported.","action":"Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. Builds patched on 12 Oct still need this release. Hunt GitLab worker crash and Org-mode render timeout logs."},"seenInTheWild":[{"metric":"third-party-stated","value":"Not a GitLab statement","observer":"Rapid7 (ETR 13 Oct, updated 16 Oct)","date":"2026-10-13","method":"Rapid7 ETR published 13 Oct 2026, last updated 16 Oct 2026. No confirmed in-the-wild exploitation of CVE-2026-97229. Lab reproduction only.","sourceUrl":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-24","items":[{"text":"New catalog page for GitLab unauthenticated RCE (CVE-2026-110264) and related CVE-2026-97229.","headline":"New catalog page for GitLab unauthenticated RCE (CVE-2026-110264)","section":"overview","kind":"page"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-10-24","kind":"page"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","headline":"Added Act-now priority with sourced CVSS, EPSS, and CISA KEV dates","section":"priority","kind":"page"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","headline":"Added detection coverage table and JSON, IOC CSV, and STIX feeds","section":"detection","kind":"page"}]},"whatTheBugIs":"CVE-2026-110264 is an integer overflow (CWE-190) in the regular expression compiler used by GitLab Community Edition and Enterprise Edition. GitLab's 21 Oct 2026 critical patch says that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server by compiling a specially crafted regular expression. GitLab rates it CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The NVD record (checked 24 Oct 2026) is still being enriched; the 10.0 score on that page is from CNA GitLab Inc.\n\nImpacted versions, in GitLab's wording: GitLab CE/EE, all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Fixed builds are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. When GitLab names no deployment type, all types are affected (Linux package, source, Helm, and others). GitLab.com is already running the patched version. Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes. GitLab credits joaxcar via HackerOne.\n\nCVE-2026-97229 is a related but separate critical issue, fixed 12 Oct 2026 in 19.2.8, 19.3.5, and 19.4.2. GitLab and NVD describe it as an issue in GitLab CE/EE that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. GitLab's 12 Oct patch titles the issue Integer Overflow issue in CI/CD Regular Expression Compiler and maps it to CWE-190. Those 12 Oct builds sit one patch behind the 21 Oct fixes, so they remain in the CVE-2026-110264 affected ranges. Rapid7 reproduced code execution for CVE-2026-97229 on an official GitLab CE image and said an attacker must first be able to plant a malicious CI/CD configuration in a repository. Rapid7 reported no confirmed in-the-wild exploitation of CVE-2026-97229.\n\nOn 23 Oct 2026 the Ruby project (k0kubun) released 4.0.9, 3.4.12, and 3.3.13. Ruby says those releases fix bugs in Onigmo, Ruby's regular expression engine, that GitLab found could be used for remote code execution on GitLab servers. Ruby maps CVE-2026-110264 to an overflow of internal IDs in a pattern with many repeats, and CVE-2026-97229 (with CVE-2026-93577) to an integer overflow in the size of a compiled pattern. Ruby says these bugs are reached only when an application compiles a regular expression from a string that an attacker controls. Ruby has not requested CVE identifiers in Ruby for these fixes, at least for now. We have not found a statement from any other vendor. For a GitLab server, GitLab's own upgrade is the fix: GitLab patches the Ruby it ships.\n\nGitLab has not published a full technical write-up. Issue details become public on GitLab's tracker 90 days after the patch. GitLab named two detections for CVE-2026-110264 on self-managed instances: Onigmo native worker crash, and Org mode render error burst.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Unauthenticated request","detail":"A network request reaches a self-managed GitLab instance without a login."},{"id":"app","label":"Regex compiled","detail":"GitLab compiles a regular expression from input using Ruby's Onigmo engine."},{"id":"exploit","label":"Integer overflow","detail":"The compiler overflows while handling a crafted pattern. Conceptual impact class only."},{"id":"exec","label":"Code exec","detail":"GitLab says this can run arbitrary code on the GitLab server."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-23","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Last verified 24 Oct 2026 against CISA KEV catalog 2026.10.23 (released 2026-10-23T19:30:18Z, 1,756 entries). CVE-2026-110264 and CVE-2026-97229 are not listed."},"firstSeen":{"date":null,"source":"Rapid7 ETR (13 Oct 2026, updated 16 Oct 2026). GitLab has not published a statement on in-the-wild exploitation.","note":"No authoritative source we opened reports in-the-wild exploitation of CVE-2026-110264 or CVE-2026-97229 as of 24 Oct 2026. Rapid7 (ETR 13 Oct, updated 16 Oct) reproduced CVE-2026-97229 in a lab on an official GitLab CE image and said there was no confirmed in-the-wild use. GitLab has not published a statement on exploitation. For CVE-2026-110264, only crash-level public PoC claims have been reported; we did not verify those repositories."},"vendorStatements":[{"vendor":"GitLab","date":"21 Oct 2026","statement":"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. … GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not need to take action.","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","retracted":false},{"vendor":"GitLab","date":"12 Oct 2026","statement":"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. … GitLab.com is already running the patched version. All GitLab Dedicated tenants were patched using an internal release before this patch release was published.","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","retracted":false},{"vendor":"Ruby","date":"23 Oct 2026","statement":"We have released Ruby 4.0.9, 3.4.12 and 3.3.13. They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers. … These bugs are reached only when an application compiles a regular expression from a string that an attacker controls, for example by passing it to Regexp.new, Regexp.union or Regexp.compile, or by interpolating it into a regexp literal such as /#{input}/. Applications that only use regular expressions written by their own developers are not affected. … We have not requested CVE identifiers in Ruby for these fixes, at least for now.","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","retracted":false}]},"timeline":[{"date":"2026-10-12","event":"GitLab released 19.4.2, 19.3.5, and 19.2.8 and published CVE-2026-97229 (CVSS 10.0) as an integer overflow in the CI/CD regular expression compiler.","source":{"title":"GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","publisher":"GitLab"},"kind":"patch","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-13T02:17:00.840Z","event":"NVD published CVE-2026-97229 at 02:17 UTC. Affected: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. CWE-190. CVSS 10.0. GitLab and NVD wording includes due to insufficient regular expression validation.","source":{"title":"NVD - CVE-2026-97229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-24"},{"date":"2026-10-14T13:55:26.987Z","event":"NVD last updated CVE-2026-97229 (13:55 UTC).","source":{"title":"NVD - CVE-2026-97229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-24"},{"date":"2026-10-13","event":"Rapid7 published an ETR for CVE-2026-97229: lab-reproduced code execution on official GitLab CE 19.4.1, requires a planted CI configuration first, no confirmed in-the-wild use.","source":{"title":"CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab","url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","publisher":"Rapid7"},"kind":"poc","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-16","event":"Rapid7 published a technical analysis of one CVE-2026-97229 route and detection pointers in Workhorse and Puma logs.","source":{"title":"Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)","url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","publisher":"Rapid7"},"kind":"other","addedDate":"2026-10-24"},{"date":"2026-10-21","event":"GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 and published CVE-2026-110264 (CVSS 10.0). Affected from 7.0. Detections named: Onigmo native worker crash, Org mode render error burst.","source":{"title":"GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","publisher":"GitLab"},"kind":"patch","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-22T01:16:57.603Z","event":"NVD published CVE-2026-110264 at 01:16 UTC (last modified 22 Oct 2026, 23:18 UTC). CNA GitLab Inc. score 10.0. NVD enrichment still pending when we opened the record.","source":{"title":"NVD - CVE-2026-110264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","publisher":"NVD"},"kind":"disclosure","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-22","event":"CERT-EU published advisory 2026-019 for CVE-2026-110264 and pointed to GitLab's two named detections.","source":{"title":"Critical Vulnerability in GitLab Community and Enterprise Editions (2026-019)","url":"https://cert.europa.eu/publications/security-advisories/2026-019/","publisher":"CERT-EU"},"kind":"advisory","addedDate":"2026-10-24"},{"date":"2026-10-22","event":"CSA Singapore published alert AL-2026-152 for CVE-2026-110264 (CVSS 10.0) and the GitLab affected-version list.","source":{"title":"Critical Vulnerability in GitLab (AL-2026-152)","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-152/","publisher":"Cyber Security Agency of Singapore"},"kind":"advisory","addedDate":"2026-10-24"},{"date":"2026-10-23","event":"Ruby released 4.0.9, 3.4.12, and 3.3.13 and published the Onigmo compilation-fix note covering GitLab's four CVEs, including CVE-2026-110264 and CVE-2026-97229.","source":{"title":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","publisher":"Ruby"},"kind":"patch","key":true,"addedDate":"2026-10-24"},{"date":"2026-10-22","event":"Brandefense published a defender-facing summary: 12 Oct builds still need the 21 Oct release; crash-level public PoC claims for CVE-2026-110264, not verified by Brandefense; no CISA KEV listing when they checked.","source":{"title":"GitLab CVE-2026-110264: Am I Affected and What to Do in the Next Hour","url":"https://brandefense.io/security-news/gitlab-cve-2026-110264-critical-rce-what-to-do/","publisher":"Brandefense"},"kind":"other","addedDate":"2026-10-24"},{"date":"2026-10-23","event":"Brandefense updated the same post (last updated 18:35 UTC) with the Ruby 4.0.9, 3.4.12, and 3.3.13 note.","source":{"title":"GitLab CVE-2026-110264: Am I Affected and What to Do in the Next Hour","url":"https://brandefense.io/security-news/gitlab-cve-2026-110264-critical-rce-what-to-do/","publisher":"Brandefense"},"kind":"other","addedDate":"2026-10-24"},{"date":"2026-10-24T00:15:14Z","event":"Viral Maniar posted on X about CVE-2026-110264 (attributed lead). Post text not verified; the post was not reachable when we opened it.","source":{"title":"Viral Maniar on X","url":"https://x.com/ManiarViral/status/2113786357000847806","publisher":"Viral Maniar (X)"},"kind":"other","addedDate":"2026-10-24"}],"openNotes":[{"title":"No verified public RCE PoC for CVE-2026-110264","detail":"Brandefense (published 22 Oct 2026, updated 23 Oct 2026) reported public GitHub repositories that call themselves crash-level or detector-only proofs for CVE-2026-110264, and said it had not verified or run them. Brandefense did not publish those repository URLs in a form we could open. We did not find a public RCE PoC for CVE-2026-110264. Rapid7 reproduced RCE for CVE-2026-97229. A GitHub repository named in secondary write-ups as jburgess-r7/CVE-2026-97229-PoC: link returns 404 (checked 25 Oct 2026).","sources":[{"url":"https://brandefense.io/security-news/gitlab-cve-2026-110264-critical-rce-what-to-do/","date":"2026-10-23","publisher":"Brandefense"},{"url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","date":"2026-10-13","publisher":"Rapid7"}]},{"title":"CVE-2026-97229 plant-first precondition","detail":"GitLab rates CVE-2026-97229 PR:N. Rapid7's ETR and 16 Oct analysis say the demonstrated chain needs a malicious CI configuration (and a UTF-8 repository path) planted in a public project before the unauthenticated trigger. Rapid7 notes that this conflicts with the PR:N rating and that the original report is still private.","sources":[{"url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","date":"2026-10-13","publisher":"Rapid7"},{"url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","date":"2026-10-16","publisher":"Rapid7"}]}],"defenderActions":[{"title":"Inventory self-managed GitLab","detail":"Find every self-managed GitLab CE or EE instance, including staging and forgotten hosts. GitLab.com and Dedicated on the versions GitLab named do not need a customer patch for these CVEs.","priority":"now","links":[{"label":"Find the GitLab version","href":"https://docs.gitlab.com/user/version/"}]},{"title":"Upgrade to a 21 Oct fixed build","detail":"Move each self-managed instance to the fixed build for its branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. If you applied the 12 Oct release (19.4.2, 19.3.5, or 19.2.8), you still need this upgrade.","priority":"now","links":[{"label":"GitLab 21 Oct patch release","href":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}]},{"title":"Hunt GitLab worker crashes and Org-mode render timeouts","detail":"Search Puma worker error logs for native [BUG] reports that mention org-ruby or Onigmo, and search exceptions_json.log for Timeout::Error bursts from the OtherMarkup renderer on .org files. GitLab named these detections Onigmo native worker crash and Org mode render error burst. A successful exploit can be quiet.","priority":"now","links":[{"label":"Onigmo native worker crash","href":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md"},{"label":"Org mode render error burst","href":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md"}]},{"title":"Upgrade standalone Ruby only if you compile untrusted patterns","detail":"Ruby 4.0.9, 3.4.12, and 3.3.13 fix the Onigmo bugs behind these GitLab CVEs. Ruby says applications that only use developer-written regular expressions are not affected. For GitLab itself, apply the GitLab upgrade, not a swap of system Ruby.","priority":"soon","links":[{"label":"Ruby Onigmo fix note","href":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"}]}],"detection":[{"title":"Onigmo native worker crash","detail":"GitLab published this detection for self-managed instances. Hunt the Puma worker error stream (puma_stderr.log) for a native Ruby [BUG] crash whose backtrace mentions org-ruby or Onigmo frames. GitLab says a successful CVE-2026-110264 exploit can be quiet and may not crash. Absence of a hit does not clear an attempt.","logSource":"GitLab Puma worker error log (puma_stderr.log)","kind":"generic","group":"edr","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20"},{"title":"Org mode render error burst","detail":"GitLab published this detection for CVE-2026-110264. Hunt exceptions_json.log for Timeout::Error events from the OtherMarkup renderer on .org files. GitLab's rule fires when one client produces five or more of those events in 30 minutes. This is request-side evidence in a Rails log.","logSource":"GitLab Rails exceptions log (exceptions_json.log)","kind":"generic","group":"web-proxy","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","date":"2026-10-20"},{"title":"CI lint Workhorse worker crash (CVE-2026-97229)","detail":"GitLab's 12 Oct 2026 patch names a detection called ci lint workhorse worker crash for CVE-2026-97229. GitLab's public TLDR rule for that detection, dated 2026-10-20, hunts Workhorse 502 / badgateway EOF on CI lint. Rapid7's 16 Oct analysis of the demonstrated chain also points at a several-second CI lint request in the Workhorse log that ends in HTTP 502 with an EOF, correlated with a Puma worker crash. This is for the 12 Oct CVE path, not a complete picture of CVE-2026-110264.","logSource":"GitLab Workhorse log (gitlab-workhorse/current)","kind":"generic","group":"web-proxy","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","date":"2026-10-12"}],"detectionRules":[{"id":"gitlab-sigma-onigmo-native-worker-crash","title":"GitLab org-ruby or Onigmo native worker crash","language":"sigma","query":"title: GitLab org-ruby or Onigmo native worker crash (CVE-2026-110264 / CVE-2026-93577 / CVE-2026-97229)\nid: 58461d1f-2ad8-41a8-861e-57c8b697657f\nstatus: experimental\ndescription: Detects a native Ruby [BUG] crash whose backtrace runs through the org-ruby gem or the Onigmo regex engine on self-managed GitLab instances.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-110264\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-97229\nauthor: schitakodur@gitlab.com, signals-engineering@gitlab.com\ndate: 2026-10-20\nlogsource:\n    product: gitlab\n    service: puma_stderr\n    category: application\ndetection:\n    selection_bug:\n        message|contains: '[BUG]'\n    selection_orgruby:\n        message|contains:\n            - 'org-ruby'\n            - 'headline.rb'\n            - 'regexp_helper.rb'\n            - 'regexp_matcher.rb'\n    selection_onig:\n        message|contains:\n            - 'match_at'\n            - 'onig_search_gpos'\n            - 'onig_compile'\n            - 'compile_tree'\n            - 'compile_length_tree'\n            - 'rb_str_sub_bang'\n    condition: selection_bug and (selection_orgruby or selection_onig)\nlevel: critical","logSource":"GitLab Puma worker error log (puma_stderr.log)","author":"GitLab Security (schitakodur@gitlab.com, signals-engineering@gitlab.com)","authorUrl":"https://gitlab.com/gitlab-security-oss/tldr","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","sourceDate":"2026-10-20","license":"MIT","licenseUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/LICENSE","origin":"vendor","notes":"Adapted (trimmed) from GitLab's public TLDR detections, dated 2026-10-20; detection logic unchanged. Copyright (c) 2024-present GitLab Inc.","tested":"untested"},{"id":"gitlab-sigma-org-mode-render-timeout","title":"GitLab Org-mode render timeout","language":"sigma","query":"title: GitLab Org-mode render timeout\nid: 9b1f3d2a-6c47-4e8b-bf21-0a7d9c5e4f18\nstatus: experimental\ndescription: Detects a Timeout::Error raised by the GitLab markup renderer (OtherMarkup) while rendering an .org file, recorded in exceptions_json.log.\nreferences:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-110264\nauthor: schitakodur@gitlab.com, signals-engineering@gitlab.com\ndate: 2026-10-20\nlogsource:\n    product: gitlab\n    service: exceptions_json.log\n    category: application\ndetection:\n    selection:\n        exception.class: 'Timeout::Error'\n        extra.class_name: 'OtherMarkup'\n        extra.file_name|endswith: '.org'\n    condition: selection\nlevel: medium","logSource":"GitLab Rails exceptions log (exceptions_json.log)","author":"GitLab Security (schitakodur@gitlab.com, signals-engineering@gitlab.com)","authorUrl":"https://gitlab.com/gitlab-security-oss/tldr","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","sourceDate":"2026-10-20","license":"MIT","licenseUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/LICENSE","origin":"vendor","notes":"Adapted (trimmed) from GitLab's public TLDR detections, dated 2026-10-20; detection logic unchanged. Copyright (c) 2024-present GitLab Inc.","tested":"untested"},{"id":"v2s-spl-gitlab-onigmo-bug","title":"GitLab Puma [BUG] with org-ruby or Onigmo frames","language":"spl","query":"index=gitlab sourcetype=gitlab:puma:stderr\n(\"[BUG]\")\n(\"org-ruby\" OR \"headline.rb\" OR \"regexp_helper.rb\" OR \"regexp_matcher.rb\" OR \"match_at\" OR \"onig_search_gpos\" OR \"onig_compile\" OR \"compile_tree\" OR \"compile_length_tree\" OR \"rb_str_sub_bang\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(host) as host by message\n| convert ctime(firstTime) ctime(lastTime)","logSource":"GitLab Puma worker error log (puma_stderr.log)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting query from markers in GitLab's Onigmo native worker crash detection. Tune sourcetype to your shipper.","tested":"untested"},{"id":"v2s-spl-gitlab-org-timeout","title":"GitLab OtherMarkup Timeout::Error on .org files","language":"spl","query":"index=gitlab sourcetype=gitlab:exceptions_json\nexception_class=\"Timeout::Error\" extra_class_name=\"OtherMarkup\" extra_file_name=\"*.org\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(extra_file_name) as files by host, meta_client_id, meta_remote_ip\n| where count>=5\n| convert ctime(firstTime) ctime(lastTime)","logSource":"GitLab Rails exceptions log (exceptions_json.log)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Field names follow GitLab's published exceptions_json keys, flattened. GitLab's burst threshold is five events from one client in 30 minutes.","tested":"untested"},{"id":"v2s-kql-gitlab-org-timeout","title":"GitLab OtherMarkup Timeout::Error on .org files (KQL)","language":"kql","query":"GitLabExceptions\n| where Timestamp > ago(14d)\n| where exception_class == \"Timeout::Error\"\n| where extra_class_name == \"OtherMarkup\"\n| where extra_file_name endswith \".org\"\n| summarize count() , min(Timestamp), max(Timestamp) by host, meta_client_id, meta_remote_ip\n| where count_ >= 5\n| order by count_ desc","logSource":"GitLab Rails exceptions log shipped to Microsoft Sentinel / Defender","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Table and field names vary by parser. Map GitLabExceptions to your exceptions_json.log ingestion.","tested":"untested"}],"detectionLinks":[{"title":"Onigmo native worker crash","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","author":"GitLab Security","date":"2026-10-20","note":"Named in GitLab's 21 Oct 2026 patch notes. Sigma plus a raw-log grep. For self-managed instances."},{"title":"Org mode render error burst","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","author":"GitLab Security","date":"2026-10-20","note":"Named in GitLab's 21 Oct 2026 patch notes. Exceptions-log burst on .org renders."},{"title":"ci lint workhorse worker crash (GitLab TLDR)","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/ci_lint_workhorse_worker_crash.md","author":"GitLab Security","date":"2026-10-20","note":"Named in GitLab's 12 Oct 2026 patch notes for CVE-2026-97229. Workhorse 502 / badgateway EOF on CI lint. Rapid7's 16 Oct analysis describes the same Workhorse 502 plus Puma crash for the demonstrated chain."},{"title":"Rapid7 analysis detection guidance (CVE-2026-97229)","url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","author":"Jonah Burgess, Rapid7","date":"2026-10-16","note":"Workhorse CI lint 502 and Puma worker crash pointers for the demonstrated 12 Oct chain. GitLab named the matching detection ci lint workhorse worker crash on 12 Oct 2026."}],"retrohunt":{"summary":"Search GitLab Puma worker error logs and exceptions_json.log from 12 Oct 2026 for Onigmo [BUG] crashes and OtherMarkup Timeout::Error bursts on .org files. For the related 12 Oct CVE, also hunt Workhorse CI lint requests that end in HTTP 502.","lookback":{"from":"2026-10-12","basis":"public-disclosure","rationale":"GitLab disclosed CVE-2026-97229 with the 12 Oct 2026 patch release. CVE-2026-110264 was disclosed with the 21 Oct 2026 patch release. No public first-exploitation date exists. Hunt from the earlier public disclosure.","sources":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","date":"2026-10-12","publisher":"GitLab"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","date":"2026-10-21","publisher":"GitLab"}]},"logSources":[{"name":"GitLab Puma worker error log (puma_stderr.log)","why":"GitLab's Onigmo native worker crash detection keys on native [BUG] reports with org-ruby or Onigmo frames.","required":true},{"name":"GitLab Rails exceptions log (exceptions_json.log)","why":"GitLab's Org mode render error burst detection keys on Timeout::Error from OtherMarkup on .org files.","required":true},{"name":"GitLab Workhorse log (gitlab-workhorse/current)","why":"Rapid7's CVE-2026-97229 analysis points at CI lint requests that end in HTTP 502 with EOF.","required":false},{"name":"GitLab Sidekiq log (sidekiq/current)","why":"GitLab's crash detection notes that a pipeline-vector crash can appear as a Sidekiq cluster-kill line rather than in puma_stderr.log.","required":false}],"steps":[{"title":"Search puma_stderr.log for Onigmo-attributed [BUG] crashes","detail":"Hunt native [BUG] reports that also mention org-ruby, headline.rb, regexp_matcher.rb, or Onigmo frames such as onig_compile or match_at. GitLab says this is corroborating, not standalone.","sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"}]},{"title":"Search exceptions_json.log for Org-mode render timeouts","detail":"Hunt Timeout::Error from extra.class_name OtherMarkup where extra.file_name ends in .org. GitLab treats five or more from one client in 30 minutes as a burst.","sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","date":"2026-10-20","publisher":"GitLab Security"}]},{"title":"Search Workhorse for CI lint 502s (CVE-2026-97229)","detail":"GitLab's 12 Oct 2026 patch names ci lint workhorse worker crash. For the 12 Oct CVE path Rapid7 also demonstrated, hunt several-second CI lint requests that end in HTTP 502 with an EOF error, and correlate with a Puma worker crash.","sources":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","date":"2026-10-12","publisher":"GitLab"},{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/ci_lint_workhorse_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"},{"url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","date":"2026-10-16","publisher":"Rapid7"}]}],"queries":[{"id":"v2s-rh-spl-gitlab-onigmo-bug","title":"GitLab Puma [BUG] with org-ruby or Onigmo frames since 12 Oct 2026","language":"spl","query":"index=gitlab sourcetype=gitlab:puma:stderr earliest=\"10/12/2026:00:00:00\"\n(\"[BUG]\")\n(\"org-ruby\" OR \"headline.rb\" OR \"regexp_helper.rb\" OR \"regexp_matcher.rb\" OR \"match_at\" OR \"onig_search_gpos\" OR \"onig_compile\" OR \"compile_tree\" OR \"compile_length_tree\" OR \"rb_str_sub_bang\")\n| stats count min(_time) as firstTime max(_time) as lastTime by host\n| convert ctime(firstTime) ctime(lastTime)","logSource":"GitLab Puma worker error log (puma_stderr.log)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Hits are crash byproducts, not a complete compromise proof. GitLab says a successful exploit can be quiet.","tested":"untested","timeRange":"From 2026-10-12"},{"id":"v2s-rh-spl-gitlab-org-timeout","title":"GitLab OtherMarkup Timeout::Error on .org files since 12 Oct 2026","language":"spl","query":"index=gitlab sourcetype=gitlab:exceptions_json earliest=\"10/12/2026:00:00:00\"\nexception_class=\"Timeout::Error\" extra_class_name=\"OtherMarkup\" extra_file_name=\"*.org\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(extra_file_name) as files by host, meta_client_id\n| where count>=5\n| convert ctime(firstTime) ctime(lastTime)","logSource":"GitLab Rails exceptions log (exceptions_json.log)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"GitLab's published burst threshold is five events from one client in 30 minutes.","tested":"untested","timeRange":"From 2026-10-12"},{"id":"v2s-rh-kql-gitlab-org-timeout","title":"GitLab OtherMarkup Timeout::Error on .org files since 12 Oct 2026 (KQL)","language":"kql","query":"GitLabExceptions\n| where Timestamp >= datetime(2026-10-12)\n| where exception_class == \"Timeout::Error\"\n| where extra_class_name == \"OtherMarkup\"\n| where extra_file_name endswith \".org\"\n| summarize count() , min(Timestamp), max(Timestamp) by host, meta_client_id, meta_remote_ip\n| where count_ >= 5\n| order by count_ desc","logSource":"GitLab Rails exceptions log shipped to Microsoft Sentinel / Defender","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2026-10-12, limited by retention"}],"thirdPartyQueries":[{"title":"Onigmo native worker crash (GitLab TLDR)","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","author":"GitLab Security","date":"2026-10-20","language":"sigma","license":"MIT","origin":"vendor","note":"Includes Sigma and a raw-log grep for puma_stderr.log and sidekiq/current."},{"title":"Org mode render error burst (GitLab TLDR)","url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","author":"GitLab Security","date":"2026-10-20","language":"sigma","license":"MIT","origin":"vendor","note":"Exceptions-log burst plus a preview-mismatch companion rule."}],"artefacts":[{"kind":"device-log","value":"puma_stderr.log native [BUG] with org-ruby or Onigmo frames","detail":"Crash byproduct of Onigmo exploitation attempts, per GitLab.","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","sourceDate":"2026-10-20"},{"kind":"web-log","value":"exceptions_json.log Timeout::Error from OtherMarkup on a .org file","detail":"Request-side signature GitLab names for CVE-2026-110264 render attempts.","sourceUrl":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","sourceDate":"2026-10-20"},{"kind":"web-log","value":"Workhorse CI lint request ending in HTTP 502 EOF","detail":"GitLab 12 Oct detection ci lint workhorse worker crash, and Rapid7 pointer for the demonstrated CVE-2026-97229 chain.","sourceUrl":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","sourceDate":"2026-10-12"}],"iocNote":"No published network IOCs from a source we opened as of 24 Oct 2026. GitLab sample events use documentation addresses, not observed attacker infrastructure.","hitMeaning":[{"level":"attempt","detail":"An Org-mode render timeout burst or an Onigmo-attributed worker crash, with no sign of code execution."},{"level":"likely-compromise","detail":"A crash or render burst plus unexpected child processes of Puma or Sidekiq, or new files owned by the git account, as GitLab's detection response describes."},{"level":"confirmed-compromise","detail":"Evidence that a command ran as the git user, or that instance secrets, CI variables, or tokens were taken."}],"nextSteps":[{"title":"Upgrade to a 21 Oct fixed build","detail":"Move the instance to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13.","links":[{"label":"GitLab 21 Oct patch release","href":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}]},{"title":"Preserve crash and exceptions logs","detail":"Keep the full [BUG] report, exceptions_json.log, and Workhorse lines from 12 Oct 2026 before any restart or rotation.","links":[{"label":"Onigmo native worker crash","href":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md"}]}],"limits":["GitLab says a successful CVE-2026-110264 exploit can be quiet and may not crash.","puma_stderr.log is often not shipped by default.","Benign large .org files can raise render timeouts. GitLab says to correlate with crash and Workhorse signals."],"sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"},{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","date":"2026-10-20","publisher":"GitLab Security"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","date":"2026-10-12","publisher":"GitLab"},{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/ci_lint_workhorse_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"},{"url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","date":"2026-10-16","publisher":"Rapid7"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"Self-managed GitLab CE/EE from 7.0 before the 21 Oct 2026 fixed builds. GitLab.com is already patched. Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no customer action. 12 Oct builds (19.4.2, 19.3.5, 19.2.8) are still affected by CVE-2026-110264. Standalone Ruby 4.0 / 3.4 / 3.3 before 4.0.9 / 3.4.12 / 3.3.13 is in scope only if the application compiles regular expressions from attacker-controlled input. Ruby requested no CVE of its own.","checks":[{"id":"v2s-aia-gitlab-onigmo-rce-version-1","kind":"version","title":"GitLab Help page version","detail":"GitLab docs: signed-in users open Help, then Help, at the bottom of the left sidebar. The version is at the top of that page.","command":"In the left sidebar, at the bottom, select Help > Help. Read the version at the top of the page.","affectedMeans":"Self-managed CE/EE version is from 7.0 and is before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1 for that branch. 19.4.2, 19.3.5, and 19.2.8 are still affected by CVE-2026-110264.","fixedMeans":"Version is 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, or later on that branch. GitLab.com Help shows a patched SaaS build. Dedicated on 19.3.5-internal0 or 19.4.2-internal0 or later needs no customer action.","notes":"You must be signed in on self-managed and Dedicated. This is inventory only.","sources":[{"url":"https://docs.gitlab.com/user/version/","date":null,"publisher":"GitLab Docs"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","date":"2026-10-21","publisher":"GitLab"}]},{"id":"v2s-aia-gitlab-onigmo-rce-package-2","kind":"package","title":"gitlab-rake gitlab:env:info","detail":"GitLab maintenance Rake task for Linux package and self-compiled installs. GitLab documents sudo gitlab-rake gitlab:env:info for Linux package installs and bundle exec rake gitlab:env:info RAILS_ENV=production for self-compiled installs. That GitLab doc does not list Helm for this command.","command":"sudo gitlab-rake gitlab:env:info","affectedMeans":"GitLab information Version is in an affected range (from 7.0 before the 21 Oct fixed build for that branch).","fixedMeans":"Version is 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, or later on that branch.","notes":"Run on a Rails node. Compare the Version line only; do not treat Ruby Version in the same output as the GitLab fix. Helm is not covered by that gitlab:env:info doc.","sources":[{"url":"https://docs.gitlab.com/administration/raketasks/maintenance/","date":null,"publisher":"GitLab Docs"}]},{"id":"v2s-aia-gitlab-onigmo-rce-package-3","kind":"package","title":"Linux package version-manifest.txt","detail":"GitLab package docs: after a Linux package install, GitLab and bundled library versions are in /opt/gitlab/version-manifest.txt.","command":"grep -E '^(gitlab-ce|gitlab-ee|gitlab) ' /opt/gitlab/version-manifest.txt; head -n 20 /opt/gitlab/version-manifest.txt","affectedMeans":"The GitLab package version is from 7.0 and is before the 21 Oct fixed build for that branch.","fixedMeans":"The GitLab package version is 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, or later on that branch.","notes":"Linux package path only. Helm and source installs will not have this file.","sources":[{"url":"https://docs.gitlab.com/administration/package_information/","date":null,"publisher":"GitLab Docs"}]},{"id":"v2s-aia-gitlab-onigmo-rce-version-4","kind":"version","title":"Standalone Ruby version (only if you compile untrusted patterns)","detail":"Ruby 23 Oct 2026: upgrade to 4.0.9, 3.4.12, or 3.3.13 or later. Reached only when the application compiles a regular expression from attacker-controlled input. Not a substitute for the GitLab upgrade on a GitLab server.","command":"ruby -v","affectedMeans":"Ruby 4.0 before 4.0.9, 3.4 before 3.4.12, or 3.3 before 3.3.13, and the application compiles regular expressions from untrusted strings (Regexp.new, Regexp.union, Regexp.compile, or interpolating input into a regexp literal).","fixedMeans":"Ruby 4.0.9, 3.4.12, 3.3.13, or later, or the application does not compile regular expressions from attacker-controlled input (Ruby: not affected).","notes":"For GitLab, the GitLab package upgrade is the fix. Do not treat a system ruby -v as proof a GitLab Omnibus instance is patched.","sources":[{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","date":"2026-10-23","publisher":"Ruby"}]}],"limits":["No sourced Shodan or Censys fingerprint for these CVEs. Do not invent one.","Help > Help requires a signed-in user on self-managed and Dedicated.","A system ruby -v does not tell you whether Omnibus GitLab's bundled Ruby is patched."],"sources":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","date":"2026-10-21","publisher":"GitLab"},{"url":"https://docs.gitlab.com/user/version/","date":null,"publisher":"GitLab Docs"},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","date":"2026-10-23","publisher":"Ruby"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"GitLab's 21 Oct 2026 notes name no workaround for CVE-2026-110264; the patch is the fix. Rapid7 documented two exposure reductions for the demonstrated CVE-2026-97229 path only. Ruby says that if you cannot upgrade Ruby, avoid compiling regular expressions from untrusted input.","items":[{"title":"Restrict anonymous access to public projects (CVE-2026-97229 path only)","detail":"Rapid7 13 Oct 2026: until a self-managed instance can be upgraded, restricting anonymous access to public projects can reduce exposure to the exploit path Rapid7 demonstrated for CVE-2026-97229.","limits":"Rapid7 says this addresses only the demonstrated delivery path and does not remediate the vulnerable regular expression compiler. Given for CVE-2026-97229, not for CVE-2026-110264. GitLab published no workaround for CVE-2026-110264.","verify":"Anonymous users cannot read public projects on the instance. Confirm in your GitLab admin visibility settings, then re-check after the next config change.","source":{"url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","date":"2026-10-13","publisher":"Rapid7"}},{"title":"Stop untrusted users creating or writing to public projects (CVE-2026-97229 path only)","detail":"Rapid7 13 Oct 2026: preventing untrusted users from creating or writing to public projects can reduce exposure to the demonstrated CVE-2026-97229 path. Rapid7 notes that open self-registration removes that constraint.","limits":"Does not fix the compiler. Does not cover CVE-2026-110264. Treat as delay only until the 21 Oct GitLab upgrade.","verify":"Untrusted accounts cannot create public projects or push to public projects. Confirm signup and project-creation policy, then re-check.","source":{"url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","date":"2026-10-13","publisher":"Rapid7"}},{"title":"Avoid compiling regular expressions from untrusted input (standalone Ruby)","detail":"Ruby 23 Oct 2026: if you cannot upgrade to 4.0.9, 3.4.12, or 3.3.13, avoid compiling regular expressions from untrusted input. Not a GitLab-server workaround; GitLab patches the Ruby it ships.","limits":"Ruby says Regexp.timeout does not protect against these bugs, and limiting pattern length does not reliably protect either. This is not a substitute for the GitLab upgrade.","verify":"Application code review shows no Regexp.new, Regexp.union, Regexp.compile, or interpolated regexp literal on attacker-controlled strings. Then confirm ruby -v once you can upgrade.","source":{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","date":"2026-10-23","publisher":"Ruby"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"If GitLab detections fire, treat the instance as an attempted remote code execution. Preserve crash and exceptions logs, upgrade to a 21 Oct fixed build, and rotate instance secrets GitLab names in its detection response.","containment":[{"title":"Take an internet-facing self-managed instance off the open internet if you see a crash or render burst","detail":"GitLab's Onigmo crash detection says to treat a hit as attempted remote code execution and to block the source. Contain at the edge before you rotate secrets.","sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"}]},{"title":"Upgrade to a 21 Oct fixed build, then keep hunting","detail":"GitLab: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. GitLab's crash detection says a successful CVE-2026-110264 exploit can be quiet, so a version bump does not replace log review.","sources":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","date":"2026-10-21","publisher":"GitLab"},{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"}]}],"rotate":[{"item":"Secrets in gitlab-secrets.json, CI/CD variables, runner tokens, and access tokens","reason":"GitLab's Onigmo crash detection response lists those classes of secrets if you find signs of code execution. Rapid7 says CVE-2026-97229 ran as the git user in its lab.","sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"},{"url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","date":"2026-10-13","publisher":"Rapid7"}]},{"item":"Admin sessions and any credentials the git account could read","reason":"General: a code-execution hit as the git user can read files that account can open. No vendor list of extra key names beyond the classes above.","generic":true,"sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"}]}],"evidence":[{"title":"Full Puma [BUG] crash report from 12 Oct 2026","detail":"Preserve both the Ruby-level and C-level backtraces in puma_stderr.log before restart or rotation. GitLab says native crash reports are often not shipped by default.","sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"}]},{"title":"exceptions_json.log Org-mode render timeouts","detail":"Keep Timeout::Error events from OtherMarkup on .org files, including meta.client_id and meta.remote_ip, from 12 Oct 2026.","sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md","date":"2026-10-20","publisher":"GitLab Security"}]},{"title":"Workhorse CI lint 502 lines (CVE-2026-97229)","detail":"Preserve Workhorse lines for CI lint requests that ran for several seconds and ended in HTTP 502 with EOF, plus any matching Puma worker crash.","sources":[{"url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","date":"2026-10-16","publisher":"Rapid7"}]}],"limits":["No in-the-wild persistence paths were published by a source we opened. Do not invent webshell names or file paths.","GitLab says a successful CVE-2026-110264 exploit can be quiet and may not crash."],"sources":[{"url":"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md","date":"2026-10-20","publisher":"GitLab Security"},{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","date":"2026-10-21","publisher":"GitLab"},{"url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","date":"2026-10-13","publisher":"Rapid7"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"GitLab","title":"GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","date":"2026-10-21","cve":"CVE-2026-110264"},{"vendor":"GitLab","title":"GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","date":"2026-10-12","cve":"CVE-2026-97229"},{"vendor":"Ruby","title":"Regexp compilation fixes related to GitLab's Onigmo CVEs","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","date":"2026-10-23","cve":"CVE-2026-110264"}],"coverage":[{"title":"GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13","publisher":"GitLab","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","date":"2026-10-21","type":"vendor","addedDate":"2026-10-24"},{"title":"GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8","publisher":"GitLab","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","date":"2026-10-12","type":"vendor","addedDate":"2026-10-24"},{"title":"Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264","publisher":"Ruby","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","date":"2026-10-23","type":"vendor","addedDate":"2026-10-24"},{"title":"CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab","publisher":"Rapid7","url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","date":"2026-10-13","type":"research","addedDate":"2026-10-24"},{"title":"Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)","publisher":"Rapid7 (Jonah Burgess)","url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","date":"2026-10-16","type":"research","addedDate":"2026-10-24"},{"title":"Critical Vulnerability in GitLab Community and Enterprise Editions (2026-019)","publisher":"CERT-EU","url":"https://cert.europa.eu/publications/security-advisories/2026-019/","date":"2026-10-22","type":"government","addedDate":"2026-10-24"},{"title":"Critical Vulnerability in GitLab (AL-2026-152)","publisher":"Cyber Security Agency of Singapore","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-152/","date":"2026-10-22","type":"government","addedDate":"2026-10-24"},{"title":"GitLab CVE-2026-110264: Am I Affected and What to Do in the Next Hour","publisher":"Brandefense","url":"https://brandefense.io/security-news/gitlab-cve-2026-110264-critical-rce-what-to-do/","date":"2026-10-22","type":"news","addedDate":"2026-10-24"}],"posts":[],"research":[{"title":"GitLab Critical Patch Release: 19.5.1 and backports (CVE-2026-110264)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","authors":"GitLab (credit: joaxcar via HackerOne)","date":"21 Oct 2026"},{"title":"GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (CVE-2026-97229)","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","authors":"GitLab (credit: joaxcar via HackerOne)","date":"12 Oct 2026"},{"title":"Regexp compilation fixes related to GitLab's Onigmo CVEs","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","authors":"k0kubun / Ruby (credit: Johan Carlsson / joaxcar)","date":"23 Oct 2026"},{"title":"CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab","url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","authors":"Rapid7 Intelligence","date":"13 Oct 2026"},{"title":"Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)","url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","authors":"Jonah Burgess, Rapid7","date":"16 Oct 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-110264 and CVE-2026-97229 not listed; catalog 2026.10.23)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.23, checked 24 Oct 2026"}],"impact":{"kind":"single-product","product":"GitLab CE/EE","versions":[{"version":"GitLab CE/EE 19.5","status":"affected","versions":"19.5.1","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"Impacted Versions: GitLab CE/EE: all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1"},"addedDate":"2026-10-24"},{"version":"GitLab CE/EE 19.4","status":"affected","versions":"19.4.3","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"19.4 before 19.4.3"},"statusLabel":"12 Oct 19.4.2 still affected","addedDate":"2026-10-24"},{"version":"GitLab CE/EE 19.3","status":"affected","versions":"19.3.6","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"19.3 before 19.3.6"},"statusLabel":"12 Oct 19.3.5 still affected","addedDate":"2026-10-24"},{"version":"GitLab CE/EE 19.2","status":"affected","versions":"19.2.9","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"19.2 before 19.2.9"},"statusLabel":"12 Oct 19.2.8 still affected","addedDate":"2026-10-24"},{"version":"GitLab CE/EE 19.1","status":"affected","versions":"19.1.9","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"19.1 before 19.1.9"},"addedDate":"2026-10-24"},{"version":"GitLab CE/EE 19.0","status":"affected","versions":"19.0.10","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"19.0 before 19.0.10"},"addedDate":"2026-10-24"},{"version":"GitLab CE/EE 18.11","status":"affected","versions":"18.11.13","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"all versions from 7.0 before 18.11.13"},"addedDate":"2026-10-24"},{"version":"GitLab CE/EE 7.0 through 18.10","status":"affected","versions":"18.11.13","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"all versions from 7.0 before 18.11.13"},"addedDate":"2026-10-24"},{"version":"GitLab.com","status":"vendor-managed-no-action","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"GitLab.com is already running the patched version."},"addedDate":"2026-10-24"},{"version":"GitLab Dedicated","status":"vendor-managed-no-action","vendorStatement":{"date":"21 Oct 2026","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","quote":"GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not need to take action."},"addedDate":"2026-10-24"}]},"pocs":[{"title":"Rapid7 ETR: lab-reproduced RCE for CVE-2026-97229","url":"https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/","source":"Rapid7 Intelligence","validationStatus":"validated","validationDate":"2026-10-13","notes":"Rapid7 says it reproduced arbitrary code execution on the official GitLab 19.4.1 CE Linux amd64 image and that the same input did not execute on 19.4.2. Requires a planted CI configuration first. Listed for defenders. This site does not republish exploit code. Rapid7 linked the now-404 GitHub PoC (jburgess-r7/CVE-2026-97229-PoC) at first publication on 13 Oct (checked 25 Oct 2026).","addedDate":"2026-10-24"},{"title":"Rapid7 technical analysis of CVE-2026-97229","url":"https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/","source":"Jonah Burgess, Rapid7","validationStatus":"validated","validationDate":"2026-10-16","notes":"Public analysis of one end-to-end route and detection pointers. Listed for defenders. This site does not republish exploit payloads or reproduction steps.","addedDate":"2026-10-24"}],"pocEmptyState":"No public RCE PoC for CVE-2026-110264 is confirmed by a primary source as of 24 Oct 2026. Brandefense reported crash-level public repositories and said it had not verified them. For CVE-2026-97229, Rapid7 validated lab code execution; see the index entries.","_feed":{"page":"https://vuln2shell.com/vulns/gitlab-onigmo-rce","json":"https://vuln2shell.com/vulns/gitlab-onigmo-rce.json","iocsCsv":"https://vuln2shell.com/vulns/gitlab-onigmo-rce/iocs.csv","stix":"https://vuln2shell.com/vulns/gitlab-onigmo-rce/stix.json"}}