GitLab warns of new max severity code execution vulnerability

GitLab patched CVE-2026-110264, a maximum-severity vulnerability in its Regular Expression Compiler. The compiler processes regular expressions found in configuration files. The flaw matters because a specially crafted expression could potentially move from input processing to arbitrary code execution on the server.

GitLab fixed the issue in both Community Edition and Enterprise Edition. The patched releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab described the problem as an integer overflow that, under certain conditions, could let an unauthenticated user execute code.

The article does not list every vulnerable version or a complete affected-version range. It does say that installations running affected versions should be upgraded immediately. GitLab.com already runs a patched version, while certain GitLab Dedicated releases already include the fix.

Remote code execution means an attacker can cause a computer to run code or commands they supplied from another system. The attacker does not need to be physically present. In this case, GitLab said an unauthenticated user could potentially execute arbitrary code on the GitLab server.

That outcome is especially serious because the attacker may gain control over the vulnerable application’s environment. They could potentially access information, change files, disrupt services, or use the server as a platform for further attacks. The article specifically confirms arbitrary code execution, but it does not describe every possible post-exploitation action.

The flaw received maximum-severity treatment because it combines remote access with code execution and no required authentication. GitLab urged affected installations to upgrade immediately. The company also said GitLab.com already runs a patched version, reducing the need for action by that service’s users.

Shadowserver reports more than 2,700 GitLab Community Edition instances exposed online. These systems are reachable from the internet, which can make them easier for attackers to identify and target. The figure shows the potential size of the patching problem, not the number of confirmed vulnerable systems.

The article gives no evidence that every exposed instance is affected by CVE-2026-110264. Shadowserver also does not provide information about how many tracked systems are honeypots. It likewise does not say how many owners have already applied the security fixes.

That uncertainty makes the exposure figure a warning rather than a precise vulnerability count. GitLab strongly recommends upgrading affected installations as soon as possible. Self-hosted administrators must check their versions and patch where necessary, while GitLab.com is already running a patched version.

The direct consequence was remote code execution. GitLab said that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server. “Unauthenticated” means the attacker would not need to sign in first, which raises the danger for internet-facing installations.

The attack would involve a specially crafted regular expression. GitLab identified an integer overflow during regular-expression compilation as the underlying weakness. The article does not provide exploit steps or explain precisely how the overflow is turned into code execution, but it confirms that the result could be arbitrary code running on the server.

Once code runs on a server, the possible damage depends on the system’s permissions and configuration. The source specifically establishes the risk of code execution, not a complete list of resulting actions. Administrators should therefore treat affected self-hosted versions as urgent patching targets.

A regular expression compiler is software that reads a pattern and converts or validates it so another system can process it. In GitLab, this background engine parses and validates regular expressions in configuration files. That makes it an important boundary between supplied text and server-side processing.

An integer overflow happens when a numerical calculation produces a value beyond the number range the software can represent. In security-sensitive code, that can make a size, position, or allocation calculation incorrect. Incorrect handling may cause unsafe memory or processing behavior. GitLab linked this weakness to compiling a specially crafted regular expression and possible arbitrary code execution.

The article does not provide the exact internal calculation or exploit chain. It does establish that the overflow occurs in the Regular Expression Compiler and can, under certain conditions, allow an unauthenticated user to run code. GitLab fixed the problem in multiple CE and EE releases.

Self-hosted GitLab customers operate installations that may still run affected versions. They must apply the published CE or EE updates themselves because GitLab cannot automatically patch every privately managed server. The company therefore urged all affected installations to upgrade to the latest version as soon as possible.

GitLab.com is different because GitLab operates that hosted service. GitLab said it is already running the patched version, so its users do not need to take action for this vulnerability. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later also already include the fixes.

The distinction is about responsibility and deployment status, not about a lower severity. Internet-exposed self-hosted systems remain important targets, and Shadowserver tracks over 2,700 exposed GitLab CE instances. Administrators should verify their exact release and upgrade if it falls within the affected versions.

Earlier GitLab flaws were not only theoretical. Since November 2021, CISA has flagged five GitLab vulnerabilities used in the wild, including one exploited in ransomware attacks. The article also describes CVE-2026-85706, which allowed unauthenticated attackers to read sensitive data such as credentials and other secrets.

CISA added CVE-2026-85706 to its actively exploited list one day after GitLab fixed it. Federal agencies were ordered to secure their systems within three days. The article also notes another critical remote code execution flaw, CVE-2026-97229, reported by the same researcher who reported CVE-2026-110264.

These events show why delaying updates is risky for internet-facing GitLab systems. Exploitation can involve code execution, secret theft, or ransomware activity. The article does not say whether CVE-2026-110264 is being exploited, but GitLab still recommends immediate upgrades for affected installations.