criticalWeb serverpatchedCVSS 10.022 Oct 2026
GitLab Onigmo RCE
A 10-out-of-10 hole in every self-managed version since 2014
What happened
An integer overflow in GitLab's bundled Onigmo regex compiler allows unauthenticated remote code execution. GitLab.com was patched before disclosure; self-managed instances were not.
Timeline
22 Oct 2026 · 00:00 UTC
Patch release
19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 ship the fix.22 Oct 2026 · 00:05 UTC
SaaS confirmed
GitLab states that GitLab.com already runs the patched build.22 Oct 2026 · 12:00 UTC
Exploit chatter
Public proof-of-concept discussion appears; no confirmed mass exploitation.
Sources