GitLab fixes a maximum-severity remote code execution flaw reaching back to version 7.0
October 21, 2026 (October 21, 2026)
On October 21 GitLab released patches for CVE-2026-110264, scored 10.0. An integer overflow while compiling a crafted regular expression could let an unauthenticated attacker run code on self-managed GitLab CE and EE servers. The affected code dates to 2014. GitLab.com is already fixed. GitLab did not say whether the flaw has been exploited, and as of October 22 it was not on CISA's exploited list. Servers patched on October 12 for an earlier critical regex flaw (CVE-2026-97229) are still affected, and there is no workaround.
Why it matters
A self-hosted GitLab server holds source code, pipeline settings and secrets, so a takeover can reach well beyond the server itself.
What defenders can take from it
- Upgrade to the fixed release for your version line, for example 19.5.1, 19.4.3 or 19.3.6. The October 12 patch is not enough.
- Keep self-managed GitLab off the public internet where you can, and review recent logs for unusual regular-expression input.