GitLab patches maximum-severity RCE vulnerability affecting 12 years of releases
Key Takeaway
A maximum-severity integer overflow bug in GitLab allows unauthenticated remote code execution.
Summary
GitLab has released patches for CVE-2026-110264, a maximum-severity integer overflow vulnerability that affects both Community Edition (CE) and Enterprise Edition (EE). The flaw occurs during regular-expression compilation and could allow unauthenticated attackers to execute arbitrary code on self-managed servers. Affected versions date back to GitLab 7.0, released in 2014.
Technical details of CVE-2026-110264
- Vulnerability Type: Integer overflow during regular-expression compilation.
- Impact: Unauthenticated remote code execution (RCE) on self-managed instances.
- CVSS Score: 10 (Maximum severity).
- Affected Versions: GitLab 7.0 and later (including CE and EE).
- Fixed Versions: 19.5.1, 19.4.3, 19.3.6, and backported to 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
- Scope: GitLab-managed infrastructure (GitLab.com and GitLab Dedicated) is not affected.
Why it matters
Since GitLab repositories often contain CI/CD configurations, deployment secrets, and access tokens, a server-level compromise could lead to supply chain attacks or lateral movement within production environments.
What to do
- Update self-managed GitLab Community Edition or Enterprise Edition instances to versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13.
- Use the two threat detections released by GitLab for self-managed instances.
Original reference: www.theregister.com →