If you self-host GitLab, stop and check your version. GitLab released patches for a maximum-severity flaw, CVE-2026-110264, that could let an unauthenticated attacker run arbitrary code on the server, BleepingComputer reports.
The bug
- It’s an integer overflow in GitLab’s Regular Expression Compiler, which parses and validates regular expressions in configuration files. A specially crafted regular expression can trigger it.
- A researcher using the handle “joaxcar” reported it through GitLab’s HackerOne bug bounty program.
Fixed versions
GitLab Community and Enterprise Editions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later don’t need to act.
Why it’s a big deal
- Shadowserver tracks over 2,700 GitLab Community Edition instances exposed online, though it can’t say how many are honeypots or already patched.
- Ten days ago GitLab warned about another critical RCE, CVE-2026-97229 (CVSS 10), in the CI/CD Regular Expression Compiler, reported by the same researcher.
- Last month another maximum-severity bug, CVE-2026-85706, let unauthenticated attackers read secrets from vulnerable servers. CISA added it to its exploited-vulnerabilities list the next day.
- BleepingComputer’s report doesn’t mention exploitation of CVE-2026-110264 in the wild, but that’s not a reason to wait.
What to do
- Check your GitLab version and upgrade to the fixed release for your branch. GitLab’s upgrade path tool helps if you’re several versions behind.
- Take a backup before upgrading and confirm you can restore it.
- If a GitLab instance doesn’t need to face the internet, put it behind a VPN or an allowlist.
- After patching, review recent logins, new access tokens, runners and project hooks for anything you don’t recognize.
My take
Three serious GitLab bugs in about a month, and two of them regex-compiler issues from the same researcher. That’s a pattern, and a reminder that anything running a lot of parsing code on untrusted input should be reachable by as few people as possible. Patch today.
Have a blessed day! And Happy Hacking!
