GitLab Patches Maximum-Severity Flaw That Could Enable Unauthenticated Code Execution

GitLab has shipped emergency fixes across seven release branches for CVE-2026-110264 and is urging self-managed administrators to patch promptly, especially because some upgrades may cause downtime on single-node installations. The flaw affects every GitLab version dating back to 7.0, released in 2014.

The vulnerability stems from an integer overflow when GitLab compiles a specially crafted regular expression using its bundled Onigmo engine. GitLab issued fixes for seven release branches: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Only self-managed installations need to take action. GitLab.com already runs a fixed version, and GitLab Dedicated instances on 19.3.5-internal0 or 19.4.2-internal0 and later do not need a separate fix.

GitLab said it had no indication that the flaw had been used in attacks. As of October 22, CVE-2026-110264 was also absent from CISA's catalog of known exploited vulnerabilities. The issue was reported by security researcher joaxcar, who has reported four code-execution flaws in GitLab's regular-expression engine within a month. The vulnerability report details the issue.

GitLab also published two detection rules to help self-managed administrators search application logs for possible exploitation attempts. Administrators upgrading to versions 19.4.3 or 19.3.6 should note that those releases include database changes that can cause downtime on single-node installations.

If you run a self-managed GitLab installation, would you update immediately despite the possibility of downtime?