GitLab CE/EE CVE-2026-110264 (CVSS 10.0): unauthenticated code execution via an integer overflow in the regular expression compiler, affecting all versions from 7.0 — GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on 21 October

GitLab said it released GitLab Community Edition and Enterprise Edition 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on 21 October 2026 and strongly recommends that all self-managed installations upgrade immediately. GitLab says the critical flaw, CVE-2026-110264, could under certain conditions have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to an integer overflow when compiling a specially crafted regular expression; it rates it CVSS 3.1 10.0 and lists all CE/EE versions from 7.0 as affected up to the fixed releases. GitLab says it backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 in addition to its standard patch releases, that GitLab.com is already running the patched version, and that GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes. GitLab has released two threat detections for self-managed customers, 'Onigmo native worker crash' and 'Org mode render error burst'. Researcher joaxcar reported the flaw through GitLab's HackerOne bug bounty programme. GitLab's release also fixes 11 further security issues rated high, medium or low, including an account takeover flaw when OmniAuth SAML and LDAP auto-linking are both enabled (CVE-2026-15723, CVSS 8.2) and an OAuth/OIDC discovery cache-poisoning flaw (CVE-2026-112212, CVSS 7.5). GitLab says the patch includes database migrations, so single-node instances will have downtime during the upgrade, while multi-node instances can apply it without downtime using zero-downtime upgrade procedures. According to The Hacker News, GitLab's 12 October fix for the earlier regex-compiler flaw CVE-2026-97229 covered only 19.2 and later, so an instance updated then is in range again, and GitLab's advisory offers no interim workaround. Primary: GitLab Critical Patch Release 19.5.1 (21 Oct); wire: The Hacker News (21 Oct).

Product

GitLab Community Edition (CE) and Enterprise Edition (EE), self-managed — regular expression compiler

Versions

Affected (GitLab): CE/EE all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. Fixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (21 Oct 2026). GitLab.com already patched; GitLab Dedicated on 19.3.5-internal0 / 19.4.2-internal0 or later already fixed. As of 22 Oct.

CVSS

10.0 (GitLab, CVSS 3.1)

Exploited in Australia?

unknown

Patch to

Upgrade self-managed GitLab CE/EE now to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13 (GitLab lists every version from 7.0 as affected, so older instances must move to one of these). Plan for downtime on single-node instances because the patch runs database migrations; multi-node instances can use GitLab's zero-downtime upgrade procedure. Use GitLab's 'Onigmo native worker crash' and 'Org mode render error burst' detections to look for exploitation attempts. GitLab.com and GitLab Dedicated customers need no action.

Primary: GitLab Docs — Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (21 Oct 2026) · Vendor: GitLab — CVE-2026-110264 Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE · CVE: CVE-2026-110264, CVE-2026-15723, CVE-2026-112212, CVE-2026-97229 · The Hacker News — Critical GitLab flaw (CVSS 10.0) could allow unauthenticated RCE across 12 years of releases (21 Oct 2026)

vulnerabilities cloud