# GitLab patches critical flaw exposing self-managed servers to code execution

- URL: https://talkfuse.com/story/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/
- Published: 2026-10-22T17:36:30+00:00
- Updated: 2026-10-22T20:09:47+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854
- Topics: Software

## Key points

- A critical GitLab flaw could enable unauthenticated code execution.
- Vulnerable releases reach back to GitLab 7.0 in 2014.
- No exploitation is reported; GitLab urges an immediate upgrade.

## Summary

GitLab has patched a maximum-severity vulnerability that could let unauthenticated attackers run arbitrary code on some self-managed servers. The flaw affects releases dating back to 2014, so organisations using vulnerable versions are urged to upgrade promptly.

Tracked as CVE-2026-110264, the bug is an integer overflow triggered while compiling a specially crafted regular expression. GitLab issued fixes across several release branches, including versions 19.5.1, 19.4.3 and 18.11.13; its hosted services are already patched. There are no reported exploitation attempts so far, but the flaw has a CVSS score of 10, and a separate maximum-severity GitLab bug was attacked shortly after its patch last month.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.