CVE-2026-110264
CVE-2026-97229Allows unauthenticated remote code execution in GitLab
GitLab has fixed two maximum-severity vulnerabilities in its regular expression compiler. The flaws are integer overflows, a type of calculation error, that let unauthenticated attackers run arbitrary code on vulnerable servers. Administrators of self-managed GitLab CE and EE are urged to patch immediately, and the flaws are not known to be actively exploited.
GitLab · Updated 28 Oct · From 2 of our stories and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 10.0 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| GitLab 19.5 | 19.5.1 |
| GitLab 19.4 | 19.4.3 |
| GitLab 19.3 | 19.3.6 |
| GitLab 19.2 | 19.2.9 |
What to do
- Upgrade GitLab CE or EE to a fixed version immediately; the patched versions are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1 for the first flaw, and 19.2.8, 19.3.5, and 19.4.2 for the second.
- GitLab administrators of self-managed instances are urged to prioritize this patch.
- There is no workaround, so a full upgrade is required to secure the server.
What happened
- 12 OctGitLab urges immediate patching of a maximum-severity code execution flaw in its CI/CD regex compiler.
- 16 OctRapid7 publishes an analysis of the CI/CD regex integer overflow.
- 22 OctGitLab patches a maximum-severity remote code execution flaw in its regex compiler and urges upgrades.
The 2 records
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-110264 | Integer Overflow or Wraparound in GitLab | critical 10.0 | No | 1.0% |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLab | critical 10.0 | No | 18% |
Our reporting
22 OctGitLab patches maximum-severity remote code execution flaw in regex compiler12 OctGitLab urges immediate patching of maximum-severity code execution flawReported elsewhere
Rapid7 · 16 OctRapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) ↗The records
CVE-2026-110264 on NVD ↗CVE-2026-97229 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works