What changed

The older emergency patch is not the new fix

GitLab released another critical patch on 21 October. CVE-2026-110264 is an integer overflow in regular-expression compilation that, under certain conditions, could let an unauthenticated attacker run code on a GitLab server. GitLab rates it CVSS 10.0 and urges operators of affected self-managed Community and Enterprise Edition instances to upgrade immediately.

This is a separate advisory from CVE-2026-97229, which GitLab patched on 12 October. Both involve regular-expression processing and server-side code execution. That similarity makes an old remediation ticket easy to mistake for closure of the new issue. The version running now is the evidence that matters.

Check the right fixed release

GitLab lists 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 as fixed releases for this advisory. Earlier October patch levels do not establish that CVE-2026-110264 is addressed.

Defender workflow

Treat each installation as its own patch decision

  1. 1

    Find self-managed GitLab instances. Include internal, internet-facing, staging and business-unit instances. Record the running version, not merely the planned package or image tag.

  2. 2

    Upgrade on the correct path. Use GitLab's affected-version table and upgrade guidance to reach a fixed release. Verify the version after the service has restarted.

  3. 3

    Preserve a narrow look-back. GitLab published two detections for self-managed customers: Onigmo native-worker crashes and bursts of Org-mode render errors. Review them as investigation leads alongside server and access logs; an alert is not proof of successful execution.

Defender note

The patch closes exposure; the record explains what was checked

GitLab.com is patched, and GitLab says Dedicated tenants on the specified internal builds already have the fixes. For self-managed systems, the useful handoff is a short inventory: each instance, its old and new version, the time it was updated, and what evidence was available for the period before that update. Keep the two October CVEs separate in that record.