---
title: "Discussion on \"GitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of Releases\" | Hashnode"
description: "Discussion on \"GitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of Releases\". GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in Onigmo regex engine affecting every self-managed release since 7.0 (2014). Upgrade now."
url: "https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [GitLab CVE-2026-110264: CVSS 10.0 RCE Hits 12 Years of Releases](https://404-founders.com/blog/alert-gitlab-cve-2026-110264-rce?utm_source=hashnode&utm_medium=feed)

GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in Onigmo regex engine affecting every self-managed release since 7.0 (2014). Upgrade now.

Oct 22 · 7 min read · 404-founders.com  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#vulnerability](https://hashnode.com/tag/vulnerability)
-   [#gitlab](https://hashnode.com/tag/gitlab)
-   [#rce](https://hashnode.com/tag/rce)

## Written by

[404 Founders](https://hashnode.com/@404-founders)

@404-founders · Bosnia and Herzegovina, Estonia

  
[View profile](https://hashnode.com/@404-founders)

Error-proof Cyber Solutions

Securing the digital frontier. Error-proof cyber solutions.

## Responses 1

Markdown supported · ⌘↵ to post

[Damiano Bianda](https://hashnode.com/@damianobianda)

[Oct 30](https://hashnode.com/posts/alert-gitlab-cve-2026-110264-rce/6ada4e4a4601ccec5f7882df/comment/6ae46fa800da92b8af14d174)

What made this family real for operators: CVE-2026-97229, one of the four, is already in CISA's Known Exploited Vulnerabilities catalog after the Alpine Linux incident in October - a newly registered account crashed GitLab worker processes 8 times with crafted CI configs, got partway through the exploit on 4 of them, and even downloaded Alpine's container image to tune the attack. Those repeated crashes were the only visible tell, so repeated worker crashes under regex-heavy CI configs this month are not noise. One more useful detail: the upstream Ruby releases of October 23 (3.3.13 / 3.4.12 / 4.0.9) fix all four CVEs, but each maps to a different Ruby change, so "we patched Ruby" is worth verifying per release line.