GitLab Backports CVE-2026-110264 Fix to Releases Back to 7.0 After Onigmo Integer Overflow

GitLab addressed the flaw across seven branches with backports to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 beyond its normal three-release support window. The vulnerability occurs during compilation of crafted regular expressions in Ruby's Onigmo engine, which GitLab ships and modifies in all packages since 7.0. No exploitation has been observed and the issue is absent from CISA KEV as of October 22, though GitLab withheld the exact preconditions required to reach the vulnerable code path.

Procurement records and release notes show GitLab has maintained custom Onigmo patches for over a decade without isolating the component, creating a persistent supply-chain vector. The same researcher reported three prior regex RCEs in September and October 2026; only this one reached pre-19.2 versions. Official advisories list two additional high-severity issues in the same release involving SAML account takeover and OAuth cache poisoning, yet omit any configuration-based mitigations.

The 12-year exposure window stems directly from bundling decisions visible in GitLab's own build manifests rather than any novel attack technique. Detection rules published in Sigma format for TLDR framework logs provide the only interim visibility, targeting worker crashes and org-mode render bursts. Database migrations bundled in 19.3.6 and 19.4.3 will force downtime on single-node deployments during upgrade.

Self-managed operators should apply the listed patches immediately and monitor the two new Sigma rules. Future component isolation audits of Onigmo and similar vendored libraries will be required to close equivalent long-term exposure paths before the next researcher disclosure.