title: GitLab Org-mode Render Timeout (CVE-2026-110264 attempt indicator)
id: 5a7e2c19-6d40-4f8b-b3e2-9c0d1f6a8e27
status: experimental
description: |
    Timeout::Error from GitLab's OtherMarkup renderer on an .org file in exceptions_json.log. GitLab's TLDR
    "Org mode render error burst" rule uses this as the base event and alerts at 5+ per client in 30 minutes;
    implement that threshold as a correlation in your SIEM.
references:
    - https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md
author: Cybaverse
date: 2026-10-21
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-110264
logsource:
    product: gitlab
    service: exceptions_json
detection:
    selection:
        exception.class: 'Timeout::Error'
        extra.class_name: 'OtherMarkup'
        extra.file_name|endswith: '.org'
    condition: selection
falsepositives:
    - Large legitimate .org documents
level: medium