GitLab has published fixes for a critical vulnerability that enables remote code execution without authentication on self-managed instances. The flaw, identified as CVE-2026-110264, received the maximum CVSS 10.0 score and currently has no available mitigation.
The root cause is an integer overflow in the regular expression compiler. A specially crafted expression causes the compiler to overflow, which under certain conditions leads to arbitrary code execution on the server. The attack can be launched over the network with no credentials and requires no user interaction.
The vulnerability affects all versions from 7.0 (released in 2014) onward in both the Community and Enterprise editions. Fixed releases include 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Organizations that applied the October 12 critical update remain unprotected, as that package only addressed the earlier CVE-2026-97229 (also CVSS 10.0) and covered versions 19.2 and later.
GitLab.com is already running the patched version. Tenants of GitLab Dedicated starting from 19.3.5-internal0 and 19.4.2-internal0 have received the update. Self-managed deployments require database migrations that will cause downtime on single-node instances.
The update bundle contains 12 CVEs in total. The critical issue was reported by researcher joaxcar through the company's HackerOne bug bounty program. Offensive security firms such as HackerSec treat maximum-severity flaws in CI/CD servers as high priority because these systems often store cloud credentials and sign production artifacts.
As of October 22, no exploitation attempts have been reported. The vulnerability does not yet appear in the NVD or CISA's list of actively exploited vulnerabilities. GitLab has published two detection rules focused on regex compiler crashes and repeated markup rendering errors for organizations unable to patch immediately.
