GitLab Releases Emergency Fixes for Critical CVE-2026-110264 Vulnerability

GitLab CVE-2026-110264 is a critical vulnerability in self-managed GitLab Community Edition and Enterprise Edition instances, for which the vendor released emergency security fixes on October 21, 2026. The flaw has the maximum CVSS score of 10.0 and, under certain conditions, could allow an unauthenticated attacker to execute arbitrary code on a GitLab server.

GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The affected range includes historical versions from 7.0 through the relevant fixes listed above. Administrators of self-managed deployments should therefore identify the branch in use and move to the corresponding fixed version without delay.

GitLab CVE-2026-110264: Regular Expression Processing Flaw

According to GitLab, the issue is an integer overflow when compiling a specially crafted regular expression. Under certain conditions, this could lead to remote arbitrary code execution. A significant factor is that, according to the vendor, the attacker does not need a GitLab account.

Successful exploitation could mean code execution directly on the server running GitLab. If compromised, this could affect data stored in the service as well as the environment used for development and CI/CD processes. The risk is particularly important for internet-facing instances.

In its security advisory, CERT-EU recommended rapidly updating affected assets, prioritizing systems exposed to the internet, and assessing possible compromise.

Which Deployments Require Action

The fixes apply to self-managed GitLab CE and EE deployments. According to the vendor, GitLab.com is already running a fixed version, so users of the hosted service should not perform their own server-platform update.

GitLab Dedicated does not require action if it is running version 19.3.5-internal0 or 19.4.2-internal0 and later. Administrators of other self-managed installations should deploy the relevant release from the fixed series:

• 19.5.1,
• 19.4.3,
• 19.3.6,
• 19.2.9,
• 19.1.9,
• 19.0.10,
• 18.11.13.

GitLab also published two detections for attempted exploitation intended for self-managed installations. Organizations can use them to examine their own environments alongside deploying the update.

No Independently Confirmed Attacks So Far

As of October 22, 2026, active exploitation of the GitLab CVE-2026-110264 flaw in real-world attacks had not been independently confirmed in the sources reviewed. However, this is not merely a theoretical warning: the vendor confirmed the vulnerability’s existence, severity and the availability of fixes.

GitLab has not yet published public technical details or a functional exploit proof of concept. Detailed vulnerability records are expected to become available after the standard 90-day period. Administrators should therefore not wait for further information and should make the update a priority.

Further developments will show whether the U.S. CISA or another authority adds the flaw to its catalog of actively exploited vulnerabilities. Credible reports of attacks, a possible public exploit and additional GitLab guidance for forensic review or compromise detection will also be important.

Verified and updated: October 22, 2026 15:19