GitLab patches maximum-severity remote code execution flaw in regex compiler

CVE-2026-110264 allows unauthenticated attackers to run arbitrary code; over 2,700 instances remain exposed online

By LineZotpaper

Published22 October 2026

Read Time2 min

GitLab has released security updates for a maximum-severity vulnerability in its Regular Expression Compiler that could allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers. The flaw, tracked as CVE-2026-110264, affects all versions of GitLab Community Edition and Enterprise Edition prior to the just-released patches, and the company has urged administrators to upgrade immediately.

The vulnerability stems from an integer overflow when the Regular Expression Compiler processes a specially crafted regular expression. GitLab fixed the issue in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for both Community and Enterprise editions.

"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression," the company said. "We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible."

GitLab noted that its cloud platform GitLab.com already runs the patched version, and GitLab Dedicated tenants on version 19.3.5-internal0 or later or 19.4.2-internal0 or later do not need to take action.

The vulnerability was reported by a security researcher using the handle 'joaxcar' through GitLab's HackerOne bug bounty program. The same researcher previously disclosed another critical code execution flaw (CVE-2026-97229) in the CI/CD Regular Expression Compiler, also rated 10/10, which GitLab patched ten days ago.

Internet threat watchdog Shadowserver has tracked over 2,700 GitLab Community Edition instances exposed online, though it did not specify how many are honeypots or already secured. Last month, GitLab fixed another maximum-severity flaw (CVE-2026-85706) that let unauthenticated attackers read sensitive data. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added that vulnerability to its list of actively exploited flaws within a day, ordering federal agencies to patch within three days.

GitLab's DevSecOps platform serves over 30 million registered users and is used by more than half of Fortune 100 companies, including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.

Analysis

Why This Matters

The vulnerability allows unauthenticated remote code execution, which could let attackers take full control of GitLab servers hosting sensitive source code and CI/CD pipelines.
Over 2,700 GitLab instances remain publicly exposed, and previous similar flaws have been actively exploited, raising the risk of widespread attacks if administrators do not patch quickly.
GitLab's broad adoption by major enterprises means a successful exploit could lead to supply-chain compromises across numerous organisations.

Background

GitLab provides a DevSecOps platform used by millions of developers worldwide. Since November 2021, CISA has flagged five GitLab flaws as exploited in the wild, including one tied to ransomware attacks. The latest vulnerability (CVE-2026-110264) is the third maximum-severity issue disclosed in recent weeks, all found by the same security researcher. The flaws target the Regular Expression Compiler, a backend component that parses regex patterns in configuration files.

Key Perspectives

GitLab: The company issued patches promptly and clearly communicated the severity and urgency. It also confirmed that its own cloud service and Dedicated tenants on current versions are not affected. Security researchers: The flaw's discoverer responsibly reported it via GitLab's bug bounty program, helping prevent exploitation. The pattern of related bugs suggests the compiler codebase may need deeper review. CISA and defenders: CISA's aggressive tracking of GitLab vulnerabilities and its active-exploitation alerts underscore the importance of rapid patching for critical infrastructure.

What to Watch

Whether CISA adds CVE-2026-110264 to its Known Exploited Vulnerabilities catalog, indicating in-the-wild attacks.
The speed at which exposed instances are patched, as tracked by Shadowserver.
Whether GitLab conducts a more thorough audit of the Regular Expression Compiler to prevent further integer overflow issues.

Sources

GitLab warns of new max severity code execution vulnerability · BleepingComputer

Checked

12 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedGitLab has patched a maximum-severity remote code execution flaw in its Regular Expression Compiler.BleepingComputer: “GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.”
Partly supportedCVE-2026-110264 allows unauthenticated attackers to run arbitrary code.BleepingComputer: “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server”
Partly supportedOver 2,700 GitLab CE instances remain exposed online.BleepingComputer: “Internet threat watchdog Shadowserver now tracks over 2,700 GitLab Community Edition instances exposed online, but it doesn't provide any information about how many of them are honeypots or have already been secured against attacks.”
SupportedGitLab said: “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,”BleepingComputer: “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,”
SupportedGitLab said: “We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.”BleepingComputer: “We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.”
Not in the sourcesThe flaw affects all CE and EE versions before the listed patches.BleepingComputer: “GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13”
SupportedThe flaw stems from an integer overflow when the compiler processes a specially crafted regular expression.BleepingComputer: “CVE-2026-110264 stems from an integer overflow weakness in GitLab's Regular Expression Compiler”
SupportedGitLab fixed the flaw in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for CE and EE.BleepingComputer: “GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13”
SupportedThe flaw was reported by researcher “joaxcar” through GitLab’s HackerOne bug bounty program.BleepingComputer: “This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the ' joaxcar ' handle through GitLab's HackerOne bug bounty program.”
Partly supportedGitLab patched CVE-2026-97229 ten days ago, after the same researcher disclosed it.BleepingComputer: “GitLab warned customers ten days ago about another critical remote code execution vulnerability (CVE-2026-97229) with a 10/10 CVSS base score in the CI/CD Regular Expression Compiler, reported by the same security researcher.”
SupportedLast month, GitLab fixed a maximum-severity flaw that let unauthenticated attackers read sensitive data.BleepingComputer: “Last month, it fixed another maximum-severity GitLab CE/EE flaw (CVE-2026-85706) that lets unauthenticated attackers read sensitive data”
Partly supportedCISA added that flaw to its actively exploited list within a day and ordered federal agencies to patch within three days.BleepingComputer: “One day later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its list of actively exploited flaws and ordered federal agencies to secure their systems within three days.”