AZL-111071: CVE-2026-110264 affecting package ruby for versions less than 3.3.13-0

Q: Who could exploit this issue?

Under certain conditions, an unauthenticated user could exploit the issue. No prior GitLab authentication is described as necessary.

Q: What does an attacker need to trigger the vulnerability?

The issue involves compiling a specially crafted regular expression that causes an integer overflow. The provided data does not specify the application workflow or input path through which such an expression must be supplied.

Q: Which GitLab releases are affected?

Affected releases include all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

Q: What Azure Linux ruby package version addresses the issue?

The affected package is azure-linux/ruby for versions earlier than 3.3.13-0. Upgrade to 3.3.13-0 or later.

Published Oct 22, 2026

Updated

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Affected Software

1 affected componentFixes available

azure-linux/ruby<3.3.13-0

3.3.13-0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azure-linux/ruby to a version that resolves this vulnerability.
Fixed in 3.3.13-0
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.5.1
Upgrade
Upgrade ruby to a version that resolves this vulnerability.
Fixed in 3.3.13-0

Event History

Oct 22, 2026

Advisory Published

via OSV·01:16 AM

Data Sourced

via OSV·01:16 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-110264

Frequently Asked Questions

Who could exploit this issue?

Under certain conditions, an unauthenticated user could exploit the issue. No prior GitLab authentication is described as necessary.

What does an attacker need to trigger the vulnerability?

The issue involves compiling a specially crafted regular expression that causes an integer overflow. The provided data does not specify the application workflow or input path through which such an expression must be supplied.

Which GitLab releases are affected?

Affected releases include all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

What Azure Linux ruby package version addresses the issue?

The affected package is azure-linux/ruby for versions earlier than 3.3.13-0. Upgrade to 3.3.13-0 or later.

AZL-111071: CVE-2026-110264 affecting package ruby for versions less than 3.3.13-0

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who could exploit this issue?

What does an attacker need to trigger the vulnerability?

Which GitLab releases are affected?

What Azure Linux ruby package version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who could exploit this issue?

What does an attacker need to trigger the vulnerability?

Which GitLab releases are affected?

What Azure Linux ruby package version addresses the issue?