GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.

This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the 'joaxcar' handle through GitLab's HackerOne bug bounty program.

CVE-2026-110264 stems from an integer overflow weakness in GitLab's Regular Expression Compiler, a background engine that parses and validates regular expressions in configuration files.

GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and warned users to patch their instances immediately.

"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression," the company said.