GitLab patches critical flaw exposing self-managed servers to code execution
GitLab has patched a maximum-severity vulnerability that could let unauthenticated attackers run arbitrary code on some self-managed servers. The flaw affects releases dating back to 2014, so organisations using vulnerable versions are urged to upgrade promptly.
Tracked as CVE-2026-110264, the bug is an integer overflow triggered while compiling a specially crafted regular expression. GitLab issued fixes across several release branches, including versions 19.5.1, 19.4.3 and 18.11.13; its hosted services are already patched. There are no reported exploitation attempts so far, but the flaw has a CVSS score of 10, and a separate maximum-severity GitLab bug was attacked shortly after its patch last month.
In short
- A critical GitLab flaw could enable unauthenticated code execution.
- Vulnerable releases reach back to GitLab 7.0 in 2014.
- No exploitation is reported; GitLab urges an immediate upgrade.
Read the full article at the source →
Originally published by The Register as “Max-severity GitLab bug allows remote code execution over 12 years of releases”.