GitLab Reports Critical Vulnerability with a CVSS Score of 10

On October 21, 2026, GitLab published a security bulletin about several vulnerabilities. One of them was the critical CVE-2026-110264, with a CVSS score of 10: it could have allowed an unauthenticated user to execute arbitrary code on a GitLab server.

The vulnerability is related to an integer overflow in the regular expression compiler. It affected Community and Enterprise Editions: versions from 7.0 to before 18.11.13, from 19.0 to before 19.0.10, from 19.1 to before 19.1.9, from 19.2 to before 19.2.9, from 19.3 to before 19.3.6, from 19.4 to before 19.4.3, and from 19.5 to before 19.5.1. The range boundaries are specified by version: in each case, the ending version is excluded.

CERT-EU recommends that organizations update affected systems as soon as possible, prioritizing those accessible from the internet, and check for signs of compromise. GitLab also published two rules for detecting exploitation attempts.

Image: various CC BY-SA 3.0 · License

Translation editors: Соловьев В., Пеков А.