DEV Community

Anoymask
Anoymask

Posted on

GitLab CVE-2026-110264: Pre-Authentication RCE via Integer Overflow in Regular Expression Compiler

#security #threatintel

Last reviewed: October 24, 2026.

1. Overview

2. Quick Summary

An integer overflow occurs during the compilation of crafted regular expressions, allowing unauthenticated remote attackers to potentially execute arbitrary code on the GitLab server. GitLab has also released two queries to detect potential exploitation attempts.

GitLab's Org-mode detection notes identify rendering attacker-controlled Org-mode content as an unauthenticated path. The release advisory describes an integer overflow during compilation; the detection notes further describe the resulting out-of-bounds write during Onigmo matching. The documented path uses a public project holding the malicious content. The lab examples do not establish exploitation of real-world victims.

3. Attack Flow

Reconstructed Attack and Exploitation Chain from Public Information

  1. An attacker causes a vulnerable GitLab instance to render attacker-controlled Org-mode content. See the linked detection notes for the documented path and prerequisites.
  2. Regex processing reaches the Onigmo memory-corruption condition described above.
  3. Memory corruption could lead to arbitrary code execution under the privileges of the GitLab server process.
  4. If code execution succeeds, it may impact repositories, CI/CD secrets, and other assets accessible to the execution process (progression to runner compromise depends on token availability and environment isolation; actual impact remains unconfirmed).

The table summarizes the advisory and detection notes above. Defender signals are investigation candidates (Inference); follow-on impact still requires separate evidence.

Attack Stage Attacker Action and Technique Tools and Communications Defender Signals (Conditions and Artifacts)
1. Input Delivery GitLab renders attacker-controlled Org-mode content through the documented unauthenticated path HTTP document-rendering requests Abnormal requests involving the renderer; correlate with the official rules
2. Regex Processing Onigmo reaches the memory-corruption condition described above Attacker-influenced regular expression Native worker crashes or Org-mode rendering errors may corroborate an attempt
3. Code Execution (Potential) Arbitrary code execution under GitLab process privileges if successful See the linked lab material; victim payloads remain unconfirmed Suspicious child process creation by GitLab processes (sh, bash, etc.), core dump generation
4. Impact Expansion (Potential) Theft or modification of repository data, CI/CD secrets, and runner tokens accessible via process privileges GitLab internal API, local file access Unauthorized secret access, unauthorized pipeline execution, unusual outbound traffic

4. Attacker Positioning and Execution Location

  • An unauthenticated remote attacker with network reachability to vulnerable self-managed GitLab servers.

5. Victim and Administrator Perspective

Victims

  • The activity may appear as standard document viewing or configuration handling, making it difficult to identify attacks based solely on user interface displays.

Administrators and SOCs

  • May be observed as worker process crashes, a surge in Org mode rendering errors, abnormal child process creation by GitLab processes, or file and secret access.

6. Success and Failure Conditions

Success Conditions

  • Running an affected version.
  • Attacker-controlled content reaches the vulnerable rendering path described above.

Failure Conditions and Mitigations

  • Immediately update to the appropriate patched version based on your release series: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1.
  • Restrict external network reachability and unauthenticated input paths until updates are complete. If compromise is suspected, revoke and reissue tokens or rebuild runners based on investigation results; these actions do not replace the need to update.

7. Outcome Upon Success

  • Arbitrary code execution on the GitLab server.
  • Unauthorized access to repositories, CI/CD secrets, and runner-related tokens readable under the execution process privileges.
  • Potential source code modification or software supply chain compromise.

8. Observable Logs

Inference: The items below are candidates for internal investigation. Availability depends on products, permissions, configurations, and retention periods, and should be distinguished from confirmed observations in source reports. Do not attribute an event to this issue or confirm successful compromise based on a single indicator alone.

GitLab's Org-mode rule looks for at least five Timeout::Error records for .org rendering from one client within 30 minutes in exceptions_json.log. The native-crash rule correlates Ruby [BUG] reports with org-ruby/Onigmo frames in puma_stderr.log. These are corroborating signals: successful exploitation need not crash. Preserve Workhorse 502 events; a terminated request may lack its completed Rails request record, requiring host/time correlation.

Email

  • No email vectors specific to this issue have been published.

Proxy / SWG / DNS

  • Correlate HTTP requests and responses directed to GitLab with official detection guidance for Onigmo native worker crashes or surges in Org mode rendering errors (see the linked rules for request and log conditions).

Endpoint / EDR

  • Review accessible logs for Onigmo native worker crashes, rendering errors, child process creation by GitLab processes, and core dumps. A crash alone does not confirm that RCE was successful.

Identity / IdP

  • Check for unusual session establishments, unauthorized use of access tokens, and account privilege modification histories as post-incident investigation candidates.

SaaS / Cloud

  • Review GitLab audit logs, repository and pipeline change histories, and CI/CD variable and runner registration/usage histories.

Network

  • Investigate outbound communications from the GitLab host following anomalous requests, or unusual network connections to runners and internal services.

9. Assessing Attack Success

Confirmed in Public Information

GitLab has published the advisory, detection notes, and lab-based examples. The reviewed sources do not confirm exploitation of real-world victims. Successful execution in an individual environment still requires host evidence.

Internal Evaluation Criteria

  • Exploitation Attempt Observed (Success Unconfirmed): Matches with official detection queries, rendering errors, or worker crashes alone do not indicate successful RCE. Carefully verify differences between request contents and normal behavior.
  • Initial Execution Confirmed: Supported by evidence of arbitrary code execution corresponding to crafted requests or the launch of unauthorized child processes. Repository modifications and secret theft must be verified as separate stages.

10. Investigation Playbook

  • Triggers: Operation of affected versions, Onigmo worker crashes, or surges in Org mode rendering errors.
  • Initial Review: Verify running versions, deployment architecture, external exposure status, error logs, and matches with official detection queries.
  • Endpoint and Server Investigation: Preserve process trees, core dumps, file integrity, and service account activity histories on the GitLab host.
  • Authentication and Cloud Investigation: Check access tokens, CI/CD variables, runner registration status, and historical usage of connected cloud credentials.
  • Follow-on Activity: Track repository modifications, unauthorized pipeline execution, runner compromise, secret exfiltration, and internal lateral movement.
  • Containment: Apply patches, restrict reachability, revoke and reissue suspected tokens and secrets, and rebuild runners.
  • Assessment Levels: Clearly distinguish between contact, execution, authentication success, data access, and follow-on compromise stages; do not presume unconfirmed success.

11. Defense and Detection Ideas

  • Single Events: Detect Onigmo native worker crashes, surges in Org mode rendering errors, and shell execution originating from GitLab processes.
  • Time-Series Correlation: Correlate the sequence of HTTP requests, compiler errors/crashes, child process creation, secret access, and outbound communication.
  • Threat Hunting: Search proactively across pre-patch timeframes for sudden error spikes, worker crashes, anomalous process trees, and runner or token usage histories.
  • Log Limitations: The crash and request-record gaps described in Section 8 require multiple log sources; absence of a crash is not evidence of safety.
  • Priority Actions: Immediately update to patched versions, restrict external access, minimize CI secrets, isolate runner environments, and ensure long-term retention of audit logs.

12. Facts, Inferences, and Hypotheses

Facts

  • GitLab published CVE-2026-110264 with a CVSS severity score of 10.0.
  • An integer overflow occurring during the compilation of crafted regular expressions may allow unauthenticated external users to execute arbitrary code on the server under specific conditions.
  • Multiple series of GitLab CE/EE from version 7.0 onward are affected, with patches released in versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1.
  • GitLab.com has been patched. GitLab Dedicated tenants running 19.3.5-internal0 or 19.4.2-internal0, or later releases containing the fixes, do not need to take additional action.
  • GitLab published two queries to detect Onigmo native worker crashes and surges in Org mode rendering errors.

Inferences

  • If RCE is achieved, the impact could expand to repositories, runner-related tokens, CI/CD environment variables, and connected cloud credentials.

Hypotheses

No additional hypotheses. Unverified items are documented under Open Questions and Further Investigation.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application medium Path for delivering input to the vulnerable regular expression compiler prior to authentication. See the documented rendering path above; field exploitation remains unconfirmed in the reviewed sources.

14. Open Questions and Further Investigation

  • Whether the documented lab methods have been used against real-world victims, and how reliably exploitation works across deployments.
  • Impact on other products embedding Ruby/Onigmo requires separate reachability analysis; GitLab's documented path should not be generalized to every Ruby application.

15. Impact on SOCs and Organizations

Organizations operating self-managed GitLab instances for internet-facing services or external joint development should immediately update to patched versions across their deployed series, and use official GitLab detection queries along with host telemetry to conduct retrospective investigations for the pre-patch period.

16. Summary by Target Audience

  • For SOCs: Correlate and monitor for Onigmo worker crashes, surges in Org mode rendering errors, child process creation from GitLab processes, and secret access.
  • For Administrators: Immediately update self-managed GitLab instances to the patched versions for their respective series, and restrict external reachability until updates are complete.
  • For Users: GitLab.com users require no additional actions. Self-managed environment users should follow their administrator's update guidance.

Top comments (0)