GitLab patches unauthenticated code-execution flaw affecting releases dating to 2014
GitLab released fixes on 21 October for CVE-2026-110264, a critical vulnerability in its regular-expression compiler that could let an unauthenticated attacker run code on self-managed servers. GitLab rates the flaw 10.0, and says versions dating back to 7.0 are affected; it has not reported confirmed attacks.
Bottom line — Self-managed instances need the fixed release for their version line; GitLab.com already runs patched software.
Go deeper 5
-
GitLab fixed the flaw in versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1.
-
Rescana and Konfirmity warn that October 12 releases 19.4.2, 19.3.5 and 19.2.8 do not fix this separate vulnerability.
-
GitLab’s detection rules point to a possible attack path through Org mode files, but say a server crash is not proof of compromise.
-
GitLab has not published a workaround; Konfirmity says only versions 19.4.3 and 19.3.6 include database migrations.
-
Konfirmity reports the same researcher found four flaws in GitLab’s regular-expression engine within a month.