GitLab released emergency patches on October 21 for CVE-2026-110264, an integer overflow in its regular-expression compiler. Under certain conditions, an unauthenticated attacker could execute arbitrary code on a vulnerable GitLab server.
A regular expression is a pattern used to match text. The affected compiler processes those patterns; this is a server vulnerability, not a problem fixed by editing a project’s application dependencies.
Which installations need attention
The official advisory covers both Community Edition and Enterprise Edition, across deployment types. It lists these affected ranges and fixed releases:
| Affected release range | Fixed release |
|---|---|
| 7.0 through versions before 18.11.13 | 18.11.13 |
| 19.0 before 19.0.10 | 19.0.10 |
| 19.1 before 19.1.9 | 19.1.9 |
| 19.2 before 19.2.9 | 19.2.9 |
| 19.3 before 19.3.6 | 19.3.6 |
| 19.4 before 19.4.3 | 19.4.3 |
| 19.5 before 19.5.1 | 19.5.1 |
GitLab.com is already patched. GitLab says Dedicated tenants running 19.3.5-internal0 or 19.4.2-internal0 or later already include the fixes. Self-managed operators must perform their own upgrade.
What the evidence establishes
Exploitation status: vendor-confirmed vulnerability; the reviewed sources do not report confirmed attacks exploiting this CVE. GitLab credits researcher joaxcar, who reported it through the company’s bug-bounty program.
GitLab assigns a maximum 10.0 severity score under CVSS, a vulnerability scoring system. That score describes potential impact and attack conditions. It does not count compromised installations.
Sergiu Gatlan’s BleepingComputer report corroborates the release versions. Its separate count of internet-visible GitLab servers does not establish which are vulnerable, already patched, or compromised.
Upgrade and investigate as separate tasks
- Upgrade promptly using GitLab’s supported upgrade path. Older installations may need intermediate upgrade stops; the fixed-version table is not permission to skip them.
- Plan for migrations. The advisory warns of downtime on single-node installations. Versions 19.3.6 and 19.4.3 include regular database migrations; 19.4.3 also includes post-deployment migrations.
- Verify the running instance after the change. A downloaded package or updated container tag alone does not show that the service restarted successfully on patched code.
- Review GitLab’s linked detection guidance. The advisory provides checks for Onigmo native-worker crashes and bursts of Org-mode rendering errors. Investigate those signals in context; a crash alone does not prove successful code execution.
The backports to older branches address this critical flaw. Other vulnerabilities in the same release notice have different affected ranges, so read the complete advisory when choosing an upgrade target.
Caveat: GitLab has not yet disclosed the full triggering conditions; its policy delays detailed vulnerability issues for 90 days after the patch release.