GitLab on October 21 issued emergency patch releases for a critical vulnerability that lets an attacker run code on a self-managed server without logging in, and that reaches back to GitLab 7.0, released in 2014. The company confirmed that an integer overflow in the regular expression compiler used by its continuous integration and continuous delivery (CI/CD) features affects virtually all self-managed Community and Enterprise Edition releases, and shipped fixes for seven supported branches.
The new advisory, tracked as CVE-2026-110264, follows an earlier critical patch on October 12 for a related flaw, CVE-2026-97229, which had a CVSS 3.1 score of 10.0. That first fix covered only the 19.2 through 19.4 branches, meaning administrators who updated nine days ago must patch again to the newer releases to be protected against the newly documented bug.
How the flaw works
According to GitLab’s advisory for CVE-2026-97229, the integer overflow in the CI/CD regular expression compiler can be triggered by an unauthenticated attacker who submits a specially crafted regular expression in a CI/CD configuration, resulting in arbitrary code execution on the server. The CVSS vector GitLab assigned — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — indicates the flaw is exploitable over the network with low complexity, requires no privileges and no user interaction, and has a high impact on confidentiality, integrity and availability.
CERT-EU, the Centre for Cybersecurity Belgium and the Cyber Security Agency of Singapore have all issued advisories urging immediate upgrades, particularly on internet-facing instances. Belgium’s center classified the flaw as CWE-190, an integer overflow.
Who is affected
GitLab says CVE-2026-110264 affects all CE/EE releases from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.
The earlier CVE-2026-97229 affected a narrower set: versions 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, according to GitLab. Because the fixed versions for the new flaw sit one patch above those October 12 releases, instances patched to 19.2.8, 19.3.5 or 19.4.2 are still running vulnerable code.
Only self-managed installations are exposed. Censys confirmed the hosted GitLab.com service is already patched, though it did not say whether the same applies to the newly documented flaw. Aikido, a security company, wrote on X that the new CVE “reaches self-managed CE/EE instances back to version 7.0, while @gitlab.com is already patched.”
What to do
- Upgrade self-managed instances to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, depending on the branch in use.
- Prioritize internet-facing servers first, as CERT-EU and other national CERTs recommend.
- Administrators who stopped at the October 12 releases should update again, since those versions do not include the fix for CVE-2026-110264.
- Consider reviewing CI/CD configuration activity for malicious regular expressions, since that is the delivery mechanism described in the advisories.
Cleber Visconti, head of Splunk Solutions Architecture at Cisco, wrote on X that administrators should patch internet-facing instances first and then “review activity from before the fix,” given that the affected servers hold source code and CI secrets.
Open questions
No exploitation in the wild had been reported as of October 21, 2026, across GitLab’s advisories, CERT-EU, the Belgian and Singaporean agencies, Censys and trade press coverage. GitLab has not published a CVSS score for CVE-2026-110264 in the advisory reviewed, and it is unclear how the new bug relates to an integer overflow in the same compiler that was fixed on October 2 with a CVSS 9.9 rating in GitLab 19.4.1, 19.3.3 and 19.2.7 — whether the two are distinct flaws or successive refinements of the same problem.
There is also a discrepancy among government advisories: CERT-EU and Belgium’s center cite 19.3.4 as the fixed release for the 19.3 branch, while GitLab and other sources identify 19.3.5. GitLab’s own advisory is the most current primary source and lists 19.3.5.
One Response