GitLab Code Execution Flaw Triggers Urgent Security Updates

GitLab has released emergency security updates to address a maximum-severity vulnerability that could let remote attackers execute arbitrary code. The GitLab code execution flaw affects its Community Edition (CE) and Enterprise Edition (EE).

Tracked as CVE-2026-110264, the vulnerability involves an integer overflow in the platform’s Regular Expression Compiler. Under certain conditions, an attacker could exploit it without signing in.

GitLab therefore urges administrators to update affected installations as soon as possible.

Crafted Regular Expressions Could Trigger Server Attacks

The compiler processes and validates regular expressions in configuration files. However, a specially crafted expression can trigger an integer overflow during compilation.

Under the conditions GitLab describes, this weakness could allow an unauthenticated attacker to run arbitrary code on the server.

Security researcher joaxcar reported the vulnerability through GitLab’s HackerOne bug bounty programme. The same researcher also reported a separate critical compiler vulnerability earlier this month.

Seven Releases Fix the GitLab Code Execution Flaw

GitLab has addressed CVE-2026-110264 in the following CE and EE releases:

• 19.5.1
• 19.4.3
• 19.3.6
• 19.2.9
• 19.1.9
• 19.0.10
• 18.11.13

Administrators running affected versions should move to an appropriate patched release promptly.

Meanwhile, GitLab.com already runs the updated software. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later also have the fixes and need no further action.

Thousands of GitLab Servers Remain Visible Online

Shadowserver tracks more than 2,700 internet-exposed GitLab Community Edition instances worldwide.

However, that figure does not establish how many servers remain vulnerable. The data does not distinguish between patched installations, unpatched systems and possible honeypots.

Consequently, administrators should check their installed versions rather than interpret the exposure count as a tally of vulnerable servers.

Latest Patch Follows Other Critical GitLab Vulnerabilities

The update follows another maximum-severity warning issued ten days earlier. That vulnerability, CVE-2026-97229, affected the CI/CD Regular Expression Compiler and carried a CVSS score of 10.

Separately, GitLab patched CVE-2026-85706 in September. That path traversal flaw could allow unauthenticated attackers to read sensitive server data, including credentials and other secrets.

CISA subsequently added the September vulnerability to its Known Exploited Vulnerabilities catalogue. It also gave US federal agencies three days to secure affected systems.

These earlier incidents underline the importance of timely updates. However, exploitation of previous GitLab vulnerabilities does not establish active exploitation of CVE-2026-110264.