Critical GitLab Flaw CVE-2026-110264 (CVSS 10.0): Older CE and EE Installations Also at Risk

On October 21, GitLab released patches for CVE-2026-110264, a critical vulnerability rated 10.0 on the CVSS scale. Under certain conditions, it allows someone with no account to execute arbitrary code on the server. GitLab urges customers to update self-managed installations immediately.

What happened

The flaw is an integer overflow that occurs when GitLab compiles a specially crafted regular expression. Affected releases go back as far as GitLab 7.0. Checking only your newest servers is therefore not enough. You also need to cover older instances still used by your teams and vendors.

GitLab has also released the fix for some older branches. However, fixing this particular flaw does not mean those branches get full security support again. Earlier October updates also do not replace the current release.

Who needs to update

The patched versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. They cover both GitLab Community Edition and Enterprise Edition. Choose the right release and upgrade path based on GitLab’s documentation.

GitLab.com is already running the fix. GitLab also lists the relevant internal GitLab Dedicated releases as protected. Still, confirm that you are actually using a managed service. Don’t assume it based on the server name.

What to do now

• Find out which version every self-managed GitLab instance runs, and assign an owner for each update.
• Take a backup, then apply the patched release along the supported upgrade path.
• Plan for possible downtime caused by database migrations.
• Review logs using the detection rules GitLab published for exploitation attempts.

SecurHUB’s take

A server that holds source code and deployment pipelines needs an especially fast vulnerability assessment. Security audits also help you check permissions, log availability, and how much your organization depends on a platform like this.

Sources: GitLab, The Hacker News