CVE-2026-110264
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0…
- Risk score
- 74/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GitLab CE/EE has a vulnerability in all versions from 7.0 before 18.11.13, allowing an unauthenticated user to execute arbitrary code on the server due to an integer overflow when compiling a specially crafted regular expression.
- Affected
- {'products': ['GitLab CE', 'GitLab EE'], 'packages': [], 'versions': ['7.0 before 18.11.13', '19.0 before 19.0.10', '19.1 before 19.1.9', '19.2 before 19.2.9', '19.3 before 19.3.6', '19.4 before 19.4.3', '19.5 before 19.5.1']}
- Fix
- Upgrade to 18.11.13 or later, 19.0.10 or later, 19.1.9 or later, 19.2.9 or later, 19.3.6 or later, 19.4.3 or later, or 19.5.1 or later
- Exploitation
- No known exploitation
In the news
TL;DR
GitLab warns of critical code execution vulnerability (CVE-2026-110264) in all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.
- GitLab has fixed the vulnerability in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
- GitLab.com is already running the patched version.
- Shadowserver tracks over 2,700 GitLab Community Edition instances exposed online, but it doesn't provide information about how many are honeypots or have been secured.
- GitLab warned customers ten days ago about another critical remote code execution vulnerability (CVE-2026-110265).
AI summary of 1 article.
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Last activity 22 Oct 2026. Patch Forecast updates every hour.