GitLab patches unauthenticated RCE in CE and EE (CVE-2026-110264)
Original title: Max-severity GitLab bug allows remote code execution over 12 years of releases
The integer overflow reaches GitLab 7.0 from June 2014; no in-the-wild exploitation is indicated yet.
GitLab patched CVE-2026-110264, an integer overflow while compiling a specially crafted regular expression. Under certain conditions it could let an unauthenticated user execute arbitrary code on self-managed Community Edition and Enterprise Edition servers. Fixes are in 19.5.1, 19.4.3, and 19.3.6, with backports through 18.11.13. GitLab.com and GitLab Dedicated are already patched, and the vendor urges self-managed upgrades as soon as possible.
Unconfirmed: The Register says there is no indication yet of in-the-wild exploitation.
- Johan Carlsson reported the bug through GitLab’s HackerOne program.
- Fixed backports are 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
- GitLab released two threat detections for self-managed customers.
- GitLab cites 50 million registered users and over half of the Fortune 100.
- SOC Prime warns a server compromise could expose secrets and CI/CD configuration.
Impact: Unauthenticated arbitrary code execution on the GitLab server
| Product | Affected | Fixed in |
|---|---|---|
| GitLab Community Edition | Back to GitLab 7.0, released June 2014 | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 |
| GitLab Enterprise Edition | Back to GitLab 7.0, released June 2014 | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 |
- 1.Upgrade self-managed GitLab CE and EE to a listed fixed version as soon as possible.
- 2.Deploy the two GitLab threat detections on self-managed instances.
- CVEs
- CVE-2026-110264
- Vendors
- GitLab
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | <1% | PoC ×8 |
From the original article
2 min read at theregister.comVendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.