title: GitLab Worker Native Crash With Onigmo or org-ruby Frames (CVE-2026-110264)
id: 3f6a0d2e-9b7c-4c1e-8a51-7d2e4b0c9a11
status: experimental
description: |
    Native Ruby [BUG] crash or segfault in GitLab Puma/Sidekiq logs whose text references the Onigmo regex engine
    or the org-ruby gem. Based on the logic of GitLab's TLDR rule "Onigmo native worker crash"
    (id 58461d1f-2ad8-41a8-861e-57c8b697657f). Corroborating only: a successful exploit may not crash.
    Requires the whole [BUG] report to be ingested as one event (multiline); otherwise correlate per host.
references:
    - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
    - https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md
author: Cybaverse
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-110264
logsource:
    product: gitlab
    service: puma_stderr
detection:
    selection_crash:
        message|contains:
            - '[BUG]'
            - 'Segmentation fault'
            - 'Bus Error'
    selection_frames:
        message|contains:
            - 'org-ruby'
            - 'headline.rb'
            - 'regexp_helper.rb'
            - 'regexp_matcher.rb'
            - 'match_at'
            - 'onig_search_gpos'
            - 'onig_compile'
            - 'compile_tree'
            - 'compile_length_tree'
            - 'rb_str_sub_bang'
    condition: selection_crash and selection_frames
falsepositives:
    - Benign org-ruby/Onigmo bugs on malformed but harmless .org files
    - Crash reports replayed from backups or test logs
level: critical