GoKawiilGitLab patches maximum-severity RCE flaw in Regular Expression Compiler
GitLab has released patches for CVE-2026-110264, a critical integer overflow vulnerability in its Regular Expression Compiler that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. The flaw, reported by researcher 'joaxcar' via HackerOne, has been fixed in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com and GitLab Dedicated tenants on patched internal builds are already protected, but self-managed installations must upgrade immediately.
GoKawiil's interpretation of the reporting above, not reported fact.
This marks the third maximum-severity vulnerability GitLab has disclosed in recent weeks, following CVE-2026-97229 and CVE-2026-85706, suggesting a pattern of serious flaws concentrated in regex-handling code. With over 2,700 GitLab Community Edition instances currently exposed online according to Shadowserver, unpatched servers could represent a significant attack surface for remote code execution attempts.
- GitLab fixed CVE-2026-110264, a max-severity integer overflow RCE flaw in its Regular Expression Compiler.
- Over 2,700 internet-exposed GitLab CE instances remain untracked for patch status, per Shadowserver.
- This is the third critical GitLab vulnerability disclosed in recent weeks, following CVE-2026-97229 and CVE-2026-85706.
Source: bleepingcomputer.com, 2026-10-22
Published there as: “GitLab warns of new max severity code execution vulnerability”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.