Science & Tech · Cybersecurity · 2 hrs ago
GitLab fixes maximum-severity flaw that could let attackers run server code
GitLab fixed a maximum-severity flaw that could let attackers run code on vulnerable servers without logging in.
The issue affects self-managed GitLab installations, not GitLab.com, which already runs a patched version.
It stems from an integer overflow in the software’s regular-expression compiler, which processes specially crafted expressions.
The flaw reaches every GitLab release since version 7.0, first released in 2014, because GitLab includes the affected compiler in its packages.
Administrators should upgrade to the fixed release for their branch; the fix is the only certain protection, and no interim workaround is available.
GitLab also published detection rules to help administrators check logs for signs of attempted exploitation.
GitLab says it has no evidence the flaw has been used in attacks.
GitLab released patches for a maximum-severity flaw that could let unauthenticated attackers run arbitrary code on vulnerable self-managed servers.
The flaw, CVE-2026-110264, is caused by an integer overflow when GitLab’s regular-expression compiler processes a specially crafted expression.
The vulnerability affects releases dating back to version 7.0, released in 2014, according to The Hacker News.
GitLab fixed it in seven release versions and urged affected users to upgrade.
GitLab said its hosted GitLab.com service already runs a patched version.
- Who
- The flaw affects users of vulnerable self-managed GitLab installations; the company released the fixes.
- What
- CVE-2026-110264 could allow an unauthenticated attacker to execute arbitrary code on a server.
- When
- GitLab released fixes on October 21, 2026.
- Where
- Vulnerable self-managed GitLab servers.
- Why
- An integer overflow can occur when the regular-expression compiler processes a specially crafted expression.
This story does not have two clearly opposing sides.
GitLab version 7.0 was released, and The Hacker News says the flaw affects versions dating back to that release.
GitLab fixed an earlier regular-expression compiler vulnerability, CVE-2026-97229, in versions 19.2.8, 19.3.5 and 19.4.2.
GitLab released fixes for CVE-2026-110264 in seven release versions.
BleepingComputer reported that Shadowserver was tracking more than 2,700 GitLab CE instances exposed online.
- CVE
- CVE-2026-110264
- Severity
- CVSS 10.0, maximum
- Cause
- Integer overflow in the regular-expression compiler
- Fixed versions
- 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13
- Affected release history
- Version 7.0 onward, according to The Hacker News
- Exposed instances
- Shadowserver tracked more than 2,700 GitLab CE instances online
2 sources
What people are saying
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.