Critical Severity
CVE-2026-110264
Published: Oct 30, 2026
CVE-2026-110264: GitLab pre-auth RCE via Onigmo integer overflow in org-ruby. Docker-based validation, admin check script, attack surface analysis.
<p align="center">
<img src="CVE-2026-110264_poster.png" alt="CVE-2026-110264: GitLab Pre-Auth RCE via Onigmo Integer Overflow" width="100%">
</p>
# CVE-2026-110264: GitLab Pre-Auth RCE via Onigmo Integer Overflow
**CVSS 10.0** | Unauthenticated | Remote Code Execution | GitLab CE/EE
One anonymous GET request to a public project's `.org` file viewer overflows a signed-short counter in Ruby's regex engine, writes out of bounds into the Puma worker's heap, and crashes it with SIGSEGV or SIGILL. No token, no session, no cookie needed.
**Author:** al4n4n (Dadb0d)
**Write-up:** [blog.al4n4n.com/CVE-2026-110264-GitLab-Onigmo-Regex-Integer-Overflow/](https://blog.al4n4n.com/CVE-2026-110264-GitLab-Onigmo-Regex-Integer-Overflow/)
**Fixed in:** GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
---
## The bug
Onigmo (Ruby's regex engine) numbers each range repeat (`x{0,8}`) with a `MemNumType` id -- a `signed short`. The 32,768th repeat wraps to `-32768`. At match time that negative id indexes into the repeat stack array, writing out of bounds.
Ruby's fix ([493d26d](https://github.com/ruby/ruby/commit/493d26dcdea8b2f0ac5d28e057b401bc809e7fae)) rejects the pattern at compile time:
```c
reg->num_repeat++;
if ((MemNumType)reg->num_repeat <= 0) return ONIGERR_TOO_MANY_RANGE_REPEAT;
```
GitLab backports this into their bundled Ruby via [omnibus-gitlab!9922](https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/9922) and [CNG!3168](https://gitlab.com/gitlab-org/build/CNG/-/merge_requests/3168).
## Pre-auth attack surface
org-ruby's [`headline.rb:100`](https://github.com/wallyqs/org-ruby/blob/v0.9.12/lib/org-ruby/headline.rb#L100) feeds raw headline text into `Regexp.new`. GitLab renders `.org` files on the anonymous blob viewer, so any public project with a crafted `.org` file triggers the overflow on:
```
GET /<project>/-/blob/main/file.org?format=json&viewer=rich
```
No token, no session, no cookie.
## Files
| File | Purpose |
|---|---|
|