GitLab's Regex Compiler Overflow, and the Patch on 21 October
GitLab patched CVE-2026-110264, a critical regex-compiler overflow that can run code with no login on self-managed servers. The MATA cloud is not GitLab.
What did GitLab patch on 21 October 2026?
GitLab released critical patches for CVE-2026-110264, an integer overflow in its regular-expression compiler. On self-managed GitLab CE and EE, from version 7.0 up to the new patches, an unauthenticated user could run code on the server. GitLab.com is already on the fix.
On 21 October 2026 GitLab published a critical patch for self-managed Community Edition and Enterprise Edition. The issue that forced the extra backport is CVE-2026-110264: an integer overflow in GitLab's regular-expression compiler, scored 10.0 by GitLab, that can let someone who is not logged in run code on the server. The versions and the vendor wording are in the 19.5.1 patch release.
GitLab.com is already running the patched version. A self-managed instance from the 7.0 era forward is in the affected range until it is on 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. The MATA cloud is not that software. This note is how the bug came about, why a Rust pattern engine is a different object, and where the rest of the day sits: PHP2Shell, the Node.js release, and the Cloudflare edge incident.
How the compiler bug showed up
GitLab compiles regular expressions in places a stranger can reach, including on a server that has not asked the stranger to log in. An integer overflow in that compiler is not a bad repository setting. It is the compiler mis-counting a size and then trusting the count. GitLab's own sentence is that a specially crafted expression can lead to arbitrary code on the server. The expression stays in GitLab's advisory. Copying it here would not help anyone patch faster.
What the overflow means
In C and C++, a too-large count that wraps can become a too-small allocation, and the write that follows can land outside the object. That is the historical shape of this kind of critical score: network, no account, no click, and the server is the one that runs the result. GitLab backported the fix beyond the usual three maintained lines, which is how seriously they take the reach back to 7.0. An earlier October patch had already dealt with a different critical overflow in CI regular expressions. Today's CVE is the one in the 21 October release notes, and it is the one self-managed hosts have to treat as current.
Who has to upgrade
Every self-managed CE or EE install below those patch numbers. Omnibus, source, and Helm are all in scope when GitLab does not name a narrower package. GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0, or later, already have the fix. Everyone else should schedule the upgrade as the next change, starting with any instance that faces the internet. The same release also fixes a high authentication issue in OmniAuth-to-LDAP email lookup and a high cache-poisoning issue on OAuth and OIDC discovery, plus medium bugs in GraphQL email fields, SAML membership locks, internal headers, and group milestones. Upgrading for the critical item picks those up too.
Why a Rust rebuild is a different shape
Remade with Rust remakes the libraries a product would otherwise take as C. Patterns are one of those libraries. rusty_expressions is Oniguruma remade in Rust. The search page is the pure Rust alternative for Oniguruma. The program case is The Importance of Remade With Rust.
The class of bug
Safe Rust will not compile a write that uses an overflowing usize as if the allocator had handed you a larger buffer. Overflow in release builds wraps a number. It does not, by itself, hand you the next object in memory. That is the difference between GitLab's compiler bug and a Rust pattern engine. It is not a magic property of the word "regex." A Rust engine can still be slow on a hostile pattern, or wrong on a corner of syntax. The integer-overflow-to-code-execution step is the step the language takes off the table in safe code.
What we ship instead
Source for Remade lives under the Remade-With-Rust organization on GitHub, not on a self-managed GitLab that has to carry twelve years of a regex compiler. Where a product needs patterns, the crate is rusty_expressions. The wider rebuild is rebuilding the foundation of the internet.
How the MATA cloud stays off this path
mata.network is not a GitLab server. There is no GitLab regular-expression compiler in the cloud path a household joins. The field note is MATA.NETWORK in the wild. Devices on dldeploy.com do not compile GitLab CI expressions to decide whether a sensor may speak. Documents on ragconverter.com are converted locally, which is ragconverter in the wild. House news is futureweb.news.
The house does not host that compiler
If your company runs its own GitLab, this article changes nothing about the upgrade. Do the upgrade. The claim about MATA is narrower and exact: that cloud's protection from CVE-2026-110264 is that the vulnerable compiler is not in the system. The map is Vision.
What to do on a self-managed instance
Move to one of the seven patch versions above, internet-facing hosts first. Confirm GitLab.com and Dedicated only if you actually use those, since GitLab says they are already covered. Then, for any regex you ship inside your own product, prefer a Rust engine you can read over a C compiler you patch twice a month. The rest of today's record is PHP2Shell, Node.js, and Cloudflare.
FAQ
Quick answers for builders evaluating this technology.
Which GitLab versions contain the 21 October fix?
19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab says GitLab.com is already patched, and Dedicated tenants on the named internal builds already include the fix. Every other self-managed install should move.
How severe is CVE-2026-110264?
GitLab scores it 10.0, with network access, low complexity, no login, and no user interaction. The vendor's description is an integer overflow while compiling a regular expression, leading to code execution on the GitLab server. This note does not describe the expression.
Does Rust make every regular expression safe?
No. Rust makes an integer overflow in safe code a wrap or a panic, not a license to write past the end of a C buffer. That removes this class of compiler bug. It does not promise that a pattern can never be slow, surprising, or wrong. The Remade pattern crate is rusty_expressions, a Rust remake of the Oniguruma job, and it is not GitLab's compiler.
Were there other fixes in the same GitLab release?
Yes. The same patch set includes high issues in OmniAuth-to-LDAP email linking and in OAuth and OIDC discovery caching, plus several medium and low access-control bugs. The critical item is the compiler overflow. The upgrade still wants the whole release.
Where should a builder read the GitLab regex compiler note?
GitLab's 19.5.1 patch notes, then rusty_expressions, mata.network, and the same-day notes on PHP2Shell, Node.js, and the Cloudflare edge.