SecOraLens
CriticalMalwareCVE-2026-110264

12-Year-Old GitLab Vulnerability Allows Remote Code Execution on Self-Managed Server

Cyber Security News·Source published ·1 min read

What happened?

GitLab has released urgent security updates for a critical vulnerability that could let attackers run code on self-managed servers without logging in. Tracked as CVE-2026-110264, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the fixes on October 21, 2026. The affected code reaches back to GitLab 7.0, released in 2014, giving the vulnerability a roughly 12-year history. That does not mean attackers have been using it for 12 years.

Key details

  • The vulnerability stems from an integer overflow when compiling a specially crafted regular expression.
  • The flaw impacts both GitLab Community Edition and Enterprise Edition across versions dating back to 7.0 released in 2014.
  • GitLab has not reported any confirmed attacks or published a public exploit for this vulnerability.
  • Security researcher joaxcar reported the issue through GitLab's HackerOne bug bounty program.
  • The patch release addresses 12 vulnerabilities in total, including another high-severity account takeover flaw.
  • GitLab published two detection guides to help identify possible exploitation attempts in self-managed environments.

Affected

  • GitLab CE and EE versions starting with 7.0 are affected.
  • Earlier releases within the 18.11, 19.0, 19.1, 19.2, 19.3, 19.4, and 19.5 branches remain affected.

Fixes and mitigations

  1. Fixed versions include 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1.
  2. GitLab.com already runs patched software and requires no action.
  3. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0, or later already include the fixes.

What to look for

  • Onigmo native worker crash detection guide published for self-managed environments.
  • Org mode render error burst detection guide published for self-managed environments.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories