GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.

This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the 'joaxcar' handle through GitLab's HackerOne bug bounty program.

CVE-2026-110264 stems from an integer overflow weakness in GitLab's Regular Expression Compiler, a background engine that parses and validates regular expressions in configuration files.

GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and warned users to patch their instances immediately.

"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression," the company said.

"We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. [..] GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not need to take action."

Internet threat watchdog Shadowserver now tracks over 2,700 GitLab Community Edition instances exposed online, but it doesn't provide any information about how many of them are honeypots or have already been secured against attacks.

GitLab warned customers ten days ago about another critical remote code execution vulnerability (CVE-2026-97229) with a 10/10 CVSS base score in the CI/CD Regular Expression Compiler, reported by the same security researcher.

Last month, it fixed another maximum-severity GitLab CE/EE flaw (CVE-2026-85706) that lets unauthenticated attackers read sensitive data (e.g., credentials and other secrets) from vulnerable servers.

One day later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its list of actively exploited flaws and ordered federal agencies to secure their systems within three days.

Since November 2021, CISA has flagged five GitLab flaws used in the wild, including one exploited in ransomware attacks.

GitLab's DevSecOps platform has over 30 million registered users worldwide and is used by over 50% of Fortune 100 companies, including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report