Comment by molf

This seems super light on details and I had to dig to find more information. We don't use Gitlab, but we do use Ruby, so I was worried we might be impacted.

This is the best overview I found: https://lilting.ch/en/articles/gitlab-cve-2026-110264-org-mo...

The bottom line: this is an issue in Ruby's regex engine, which was fixed in April and backported recently. [1]

Everyone running applications where attacker-controlled input might find its way (unescaped) into Ruby regexes is vulnerable to remote code execution.

[1]: https://github.com/ruby/ruby/pull/16801