This seems super light on details and I had to dig to find more information. We don't use Gitlab, but we do use Ruby, so I was worried we might be impacted.
This is the best overview I found: https://lilting.ch/en/articles/gitlab-cve-2026-110264-org-mo...
The bottom line: this is an issue in Ruby's regex engine, which was fixed in April and backported recently. [1]
Everyone running applications where attacker-controlled input might find its way (unescaped) into Ruby regexes is vulnerable to remote code execution.