A recently disclosed vulnerability (CVE-2026-110264) affects GitLab Community Edition (CE) and Enterprise Edition (EE) may allow unauthenticated remote attackers to execute arbitrary code on vulnerable Gitlab servers.
Severity level:
CVSS Score: 10/Critical
Description:
CVE-2026-110264 is a critical integer overflow vulnerability in the regular-expression compiler used by GitLab. Under certain conditions, an unauthenticated attacker can submit a specially crafted regular expression that triggers the flaw and enables arbitrary code execution on the affected GitLab server.
Affected Versions: The vulnerability affected GitLab CE and EE.
- All versions from 7.0 through 18.11.12
- 19.0 before 19.0.10
- 19.1 before 19.1.9
- 19.2 before 19.2.9
- 19.3 before 19.3.6
- 19.4 before 19.4.3
- 19.5 before 19.5.1
Impact:
Successful exploitation may allow attackers to execute arbitrary code on GitLab servers.
Resolution:
Upgrade immediately to one of the following fixed versions or later.
- Gitlab 18.11.13
- Gitlab 19.0.10
- Gitlab 19.1.9
- Gitlab 19.2.9
- Gitlab 19.3.6
- Gitlab 19.4.3
- Gitlab 19.5.1
Reference:
https://nvd.nist.gov/vuln/detail/cve-2026-110264
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
https://www.cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1074
UIT Information Security