Critical Git Lab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
Summary: GitLab released fixes on October 21 for CVE-2026-110264, a maximum-severity 10.0 flaw that could let an unauthenticated user run arbitrary code on self-managed servers through an integer overflow during compilation of a specially crafted regular expression, affecting every version back to 7.0 from 2014. GitLab fixed it in seven versions at once, backporting to 18.11.13, 19.0.10, 19.1.9, and 19.2.9 outside its normal policy of patching only the current and previous two monthly releases, and said it has no sign the flaw has been exploited.
What you should know: The October 12 update covered only 19.2 and later, and the new fixed versions sit one patch above it, so an instance patched nine days earlier is in range again - and GitLab has not disclosed the preconditions, so no administrator can rule themselves out by configuration.