GitLab patches max-severity regex compiler RCE (CVE-2026-110264)
Original title: GitLab warns of new max severity code execution vulnerability
Unauthenticated users can run code via integer overflow when a crafted regular expression is compiled.
GitLab released patches for CVE-2026-110264, a maximum-severity integer overflow in its Regular Expression Compiler. Under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server by compiling a specially crafted regular expression. Researcher joaxcar reported the flaw through GitLab’s HackerOne program. Fixes are in Community Edition and Enterprise Edition 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and GitLab told users to patch immediately.
Unconfirmed: The item does not say whether CVE-2026-110264 is being exploited.
- The compiler parses and validates regular expressions in configuration files.
- Fixed CE and EE builds are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
- GitLab said the issue is remediated and urged immediate patching.
Impact: Unauthenticated arbitrary code execution on the GitLab server
| Product | Affected | Fixed in |
|---|---|---|
| GitLab Community Edition and Enterprise Edition | — | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 |
- 1.Upgrade GitLab CE and EE to one of the listed fixed versions immediately.
- CVEs
- CVE-2026-110264
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | 1% | PoC ×8 |
From the original article
2 min read at databreaches.netSergiu Gatlan reports: GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the ‘joaxcar‘ handle through GitLab’s HackerOne bug bounty program. CVE-2026-110264 stems from an integer...
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.