# GitLab patches maximum-severity RCE vulnerability affecting 12 years of releases

> **Key takeaway:** A maximum-severity integer overflow bug in GitLab allows unauthenticated remote code execution.

**Published:** 2026-10-22T17:36:30+00:00 
**Source:** The Register 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/gitlab-patches-maximum-severity-rce-vulnerability-affecting-.html 

## Summary
GitLab has released patches for CVE-2026-110264, a maximum-severity integer overflow vulnerability that affects both Community Edition (CE) and Enterprise Edition (EE). The flaw occurs during regular-expression compilation and could allow unauthenticated attackers to execute arbitrary code on self-managed servers. Affected versions date back to GitLab 7.0, released in 2014.

## Technical details of CVE-2026-110264
- **Vulnerability Type:** Integer overflow during regular-expression compilation.
- **Impact:** Unauthenticated remote code execution (RCE) on self-managed instances.
- **CVSS Score:** 10 (Maximum severity).
- **Affected Versions:** GitLab 7.0 and later (including CE and EE).
- **Fixed Versions:** 19.5.1, 19.4.3, 19.3.6, and backported to 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
- **Scope:** GitLab-managed infrastructure (GitLab.com and GitLab Dedicated) is not affected.

## Why it matters
Since GitLab repositories often contain CI/CD configurations, deployment secrets, and access tokens, a server-level compromise could lead to supply chain attacks or lateral movement within production environments.