GitLab patches unauthenticated code-execution flaw affecting releases dating to 2014
Cyber Security · Thursday, October 22, 2026 · 5 sources

GitLab patches unauthenticated code-execution flaw affecting releases dating to 2014

GitLab released fixes on 21 October for CVE-2026-110264, a critical vulnerability in its regular-expression compiler that could let an unauthenticated attacker run code on self-managed servers. GitLab rates the flaw 10.0, and says versions dating back to 7.0 are affected; it has not reported confirmed attacks.

Bottom line — Self-managed instances need the fixed release for their version line; GitLab.com already runs patched software.

Go deeper 5

  1. GitLab fixed the flaw in versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1.

  2. Rescana and Konfirmity warn that October 12 releases 19.4.2, 19.3.5 and 19.2.8 do not fix this separate vulnerability.

  3. GitLab’s detection rules point to a possible attack path through Org mode files, but say a server crash is not proof of compromise.

  4. GitLab has not published a workaround; Konfirmity says only versions 19.4.3 and 19.3.6 include database migrations.

  5. Konfirmity reports the same researcher found four flaws in GitLab’s regular-expression engine within a month.

Read the reporting 5

dstld. Your daily news summary designed to surface the news that matters from a European perspective. Curated by humans, summarized by AI - always with links back to the original reporting.

Links · Contact
Popular topics · WorldEuropeGamesAI
Last generated: Oct 22, 1:50 PM UTC by wreetco

dstld. Your daily news summary designed to surface the news that matters from a European perspective. Curated by humans, summarized by AI - always with links back to the original reporting.

Links · Contact
Popular topics · WorldEuropeGamesAI
Last generated: Oct 22, 1:50 PM UTC by wreetco