GitLab Integer Overflow in Regex Parsing Permits Remote Code Execution Without Auth
Self-managed GitLab users must upgrade to patched versions to close a critical integer overflow flaw that could allow remote code execution without authentication.
Key points
- CVE-2026-110264 affects GitLab CE and EE versions from 7.0 up to specific recent releases, carrying a CVSS score of 10.0.
- The vulnerability stems from an integer overflow during the compilation of specially crafted regular expressions, which could allow arbitrary code execution.
- GitLab released fixes on October 21, 2026, for multiple branches, including extended support for older versions beyond standard patch windows.
GitLab has issued urgent security updates to address a critical vulnerability tracked as CVE-2026-110264. According to Cyber Security News, the flaw could let attackers run code on self-managed servers without logging in. The issue affects both Community Edition and Enterprise Edition installations, spanning versions from 7.0 released in 2014 through various recent releases. This discovery follows an earlier integer overflow vulnerability patched on October 12, as SecOps Signal reported on 2026-10-12.
The risk
The National Vulnerability Database rates CVE-2026-110264 as critical with a CVSS score of 10.0. The weakness, identified as CWE-190, involves an integer overflow when the server compiles a specially crafted regular expression. Under certain conditions, processing an attacker-controlled pattern could allow arbitrary code to run on the server. GitLab’s advisory notes that the attack is network-based with low complexity, requiring no account privileges or user interaction.
Who is exposed
Self-managed customers using GitLab CE or EE versions prior to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1 are affected. GitLab.com already runs patched software, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0, or later are protected. The company extended fixes to four older branches beyond its standard release cycle. Administrators should assume all deployment types are exposed unless the advisory specifies otherwise.
Cost and compliance
GitLab credited security researcher joaxcar with reporting the issue through its HackerOne bug bounty program. The company published the fixes on October 21, 2026. GitLab’s advisory does not report confirmed attacks or provide a public exploit. The CVSS assessment indicates high impact on data privacy, integrity, and availability. The affected code reaches back to GitLab 7.0, giving the vulnerability a roughly 12-year history, though this does not imply long-term exploitation.
What to watch
Security teams should verify their GitLab version against the patched list immediately. Monitor for any unusual process spawns or network connections originating from the GitLab server that do not match expected application behavior. Ensure that internal patching procedures prioritize this update due to the unauthenticated nature of the exploit path.
Signals worth monitoring
Teams usually observe anomalous process creation or outbound network connections from web server processes when remote code execution occurs. Check whether the application logs show compilation errors or unexpected resource spikes during regular expression processing. Look for new files created in temporary directories or unauthorized changes to system binaries. Verify that audit logs capture the source IP addresses of requests triggering these anomalies. Isolate affected servers from the network to prevent lateral movement while investigating the root cause. Review firewall logs for unusual traffic patterns that might indicate command and control communication.
What to do and how to stay safe: GitLab
- Verify your current GitLab version and compare it against the list of patched releases provided by the vendor.
- Upgrade to the latest patched version immediately if your installation is within the affected range.
- Monitor server logs for signs of unauthorized code execution or unusual process activity following any requests.
- Restrict network access to the GitLab server to trusted IP addresses until the patch is applied.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which GitLab versions are affected by CVE-2026-110264?
Versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 are affected.
Is there a public exploit for this vulnerability?
No, GitLab’s advisory does not report confirmed attacks or provide a public exploit for CVE-2026-110264.
Who discovered this vulnerability?
Security researcher joaxcar reported the issue through GitLab’s HackerOne bug bounty program.
