GitLabCVE-2026-110264

GitLab: remote code execution

CVE-2026-110264 · Published Oct 22, 2026 · updated Oct 31, 2026

Critical10.0

Fix: upgrade to 18.11.13 or later (4 fixed versions below)

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 7.0, < 18.11.13	18.11.13
	>= 19.0, < 19.0.10	19.0.10
	>= 19.1, < 19.1.9	19.1.9
	>= 19.2, < 19.2.9	19.2.9

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-190

More GitLab advisories

All GitLab

Medium 6.8Oct 22

GitLab: improper authorizationCVE-2026-12664fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: missing authorizationCVE-2026-13319fixed in 19.3.6 +2 Low 3.1Oct 22

GitLab: improper access controlCVE-2026-14288fixed in 19.3.6 +2 High 8.2Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1...CVE-2026-15723fixed in 19.3.6 +2 Medium 5.9Oct 22

GitLab: improper authorizationCVE-2026-16255fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: authenticated user could access paid AI features withoutCVE-2026-112378fixed in 19.3.6 +2