home / blog
2026-10-21 · critical
GitLab: unauthenticated code execution (CVE-2026-110264)
Unauthenticated code execution in GitLab CE and EE, CVSS 10.0. Update to the fixed release for your branch.
On 21 October 2026 GitLab released fixes for CVE-2026-110264, an unauthenticated code execution vulnerability in GitLab CE and EE, with a CVSS v3.1 score of 10.0. According to the NVD description, all versions from 7.0 up to but excluding 18.11.13, and the 19.x versions before 19.5.1, are affected.
The cause is an integer overflow when compiling a specially crafted regular expression. For this reason, releases from October before 19.5.1 remain vulnerable: having applied the previous month's patch is not enough.
Update to the fixed release for your branch, restart the instance and review the service logs for anomalous activity. GitLab does not indicate alternative mitigations.
At a glance
- What
- Unauthenticated code execution on the GitLab server, in CE and EE.
- Severity
- CVSS v3.1 10.0 (critical), according to the GitLab NVD record.
- Cause
- Integer overflow when compiling a specially crafted regular expression (CWE-190).
- Affected versions
- From 7.0 up to but excluding 18.11.13, and from 19.0 up to but excluding 19.5. Releases from October before 19.5.1 are also affected.
- Fix
- GitLab 19.5.1 and 18.11.13. For other branches see the GitLab release notes.
- Action
- Update to the fixed release for your branch. GitLab does not indicate alternative mitigations: updating is the only remedy. GitLab.com is already updated.
Sources: NVD, CVE-2026-110264 · GitLab, patch release 19.5.1