GitLab Warns of New Max Severity Code Execution Vulnerability
GitLab fixed the flaw in multiple CE and EE releases and urged immediate updates after a researcher reported a maximum-severity bug through HackerOne.
- GitLab released security patches for a maximum-severity Regular Expression Compiler flaw, CVE-2026-110264, that allows remote attackers to execute arbitrary code on vulnerable servers.
- This remediation follows GitLab's warning ten days ago regarding CVE-2026-97229 and last month's patch for CVE-2026-85706, which CISA added to its list of actively exploited threats.
- Internet threat watchdog Shadowserver tracks over 2,700 Internet-exposed GitLab Community Edition instances, while GitLab's platform serves over 30 million users and over 50% of Fortune 100 companies.
- Administrators must immediately upgrade to GitLab Community Edition and Enterprise Edition versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 to remediate the flaw.
- Security researcher 'joaxcar' reported the issue through HackerOne, continuing a pattern where CISA has flagged five GitLab flaws used in the wild since November 2021, including one exploited in ransomware attacks.
18 Articles
18 Articles
GitLab Patched Its Own Copy of Ruby to Close a CVSS 10 Hole Spanning 12 Years of Releases
A second critical GitLab release in two weeks fixes CVE-2026-110264, an unauthenticated code execution bug in Ruby's Onigmo regex engine that reaches back to GitLab 7.0. Ruby's own fix is still being backported.
GitLab patches max-severity RCE affecting 12 years of releases
GitLab has fixed CVE-2026-110264, an integer overflow in regular-expression compilation that could let unauthenticated attackers execute arbitrary code on self-managed CE and EE servers under certain conditions. Affected versions reach back to...
On October 21, GitLab issued repairs to a critical gap that could affect the safety of your servers. Identify the details of this gap and how to deal with it. A critical gap in GitLab (CVSS 10.0) that would allow uncertified software instructions to be implemented through 12 years of releases. GitLab issued reforms on October 21 to a gap that would allow the attacker to run the software instructions on a managed server... the article showed a cr…
GitLab alerts about a new critical vulnerability allowing, under certain conditions, remote code execution without authentication. The editor recommends an immediate update of the installations concerned.
Coverage Details
Bias Distribution
- 60% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
