CVE-2026-110264, rated 10.0, affects GitLab Community and Enterprise Editions going back to version 7.0; GitLab.com is already patched.
GitLab on Wednesday released critical patches for its self-managed Community and Enterprise Editions, led by CVE-2026-110264, an integer overflow in the regular-expression compiler that GitLab says could let an unauthenticated user execute arbitrary code on the server. The CVE record rates it 10.0, the maximum. Affected versions run from 7.0 up to the fixed releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and GitLab says all self-managed installations should upgrade immediately. GitLab.com already runs the patched version. The release also fixes two high-severity, five medium-severity and four low-severity issues. CERT-EU advises organisations to patch internet-facing servers first and check for signs of compromise, noting GitLab has published detection rules.
Sources: GitLab · CVE record · CERT-EU · InfoWorld