GitLab Patches Maximum-Severity Flaw Enabling Unauthenticated Remote Code Execution
Summary
GitLab patched CVE-2026-110264, an integer overflow in its Regular Expression Compiler that could allow unauthenticated remote code execution. The company urged users to upgrade affected CE and EE versions.
Key points
- CVE-2026-110264 is an integer overflow in GitLab's Regular Expression Compiler that could let unauthenticated attackers execute arbitrary code on vulnerable servers.
- The flaw was reported by researcher joaxcar through GitLab's HackerOne bug bounty program.
- GitLab fixed the issue in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and recommends upgrading affected installations promptly.
- GitLab.com is already patched; GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later do not need to act.
- Shadowserver tracks more than 2,700 GitLab CE instances exposed online, but does not say how many are honeypots or already secured.
Article Details
- Vulnerability Types
- Integer overflow in the Regular Expression Compiler
- Remote code execution
- Severity
- Maximum severity
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available