GitLab patches maximum-severity code execution flaw

GitLab has released security patches for a maximum-severity flaw in its Regular Expression Compiler that could let remote attackers run arbitrary code on vulnerable servers.

Tracked as CVE-2026-110264, the vulnerability stems from an integer overflow when compiling a specially crafted regular expression. GitLab said an unauthenticated user could have executed code on a server under certain conditions. The flaw was reported by a researcher using the handle “joaxcar” through GitLab’s HackerOne bug bounty program.

GitLab fixed the issue in Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and urged affected installations to upgrade. GitLab.com is already running a patched version. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later also have the fixes, the company said.

Shadowserver tracks more than 2,700 GitLab CE instances exposed online. It does not say how many are honeypots or have already been secured.

The disclosure follows another critical Regular Expression Compiler flaw, CVE-2026-97229, which GitLab warned customers about ten days earlier. Last month, GitLab fixed CVE-2026-85706, a maximum-severity flaw that could let unauthenticated attackers read sensitive data. CISA added that vulnerability to its actively exploited list one day later and gave federal agencies three days to secure their systems.