Back Yorku.Ca

Gitlab Remote Code Execution Vulnerability (CVE-2026-110264) | UIT

Yorku.Ca • October 26, 2026

A recently disclosed vulnerability (CVE-2026-110264) affects GitLab Community Edition (CE) and Enterprise Edition (EE) may allow unauthenticated remote attackers to execute arbitrary code on vulnerable Gitlab servers. Severity level: CVSS Score: 10/Critical Description: CVE-2026-110264 is a critical integer overflow vulnerability in the regular-expression compiler used by GitLab. Under certain conditions, an unauthenticated attacker can submit a specially crafted regular expression that triggers the flaw and enables arbitrary code execution on the affected GitLab server. Affected Versions: The vulnerability affected GitLab CE and EE.

All versions from 7.0 through 18.11.12

Impact: Successful exploitation may allow attackers to execute arbitrary code on GitLab servers.

Resolution: Upgrade immediately to one of the following fixed versions or later.

UIT Information Security

IT Client Services at [email protected] or 416 736 5800

This email is viewed best in Microsoft Outlook for web

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitLab CVE-2026-110264: Critical RCE Flaw Patched GitLab released emergency patches for CVE-2026-110264 on October 21, 2026, addressing a critical remote code execution vulnerability in its regular expression compiler. The flaw, which has a CVSS score of 10.0, allows unauthenticated attackers to execute arbitrary code on self-managed servers. This vulnerability affects all self-managed GitLab Community and Enterprise Editions since version 7.0, released in 2014. GitLab backported the fix to seven branches, including 19.5.1, which was released just six days after the previous version. The researcher Johan Carlsson reported this vulnerability through GitLab's HackerOne bug bounty program. GitLab.com is not affected as it runs the patched code, leaving self-hosted instances at risk. This incident follows another critical vulnerability (CVE-2026-97229) disclosed just ten days earlier, indicating a concerning trend in the GitLab CI/CD regex compiler. 32 sources 72

Extracted Entities

Gitlab Remote Code Execution Vulnerability (CVE-2026-110264) | UIT

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

Email Addresses (1)

Platforms (1)