Live › vulnerability › CVE-2026-110264
Go to dashboardGitLab CE/EE has an integer overflow when compiling a specially crafted regular expression, across many versions from 7.0 up to the fixed releases. An unauthenticated attacker can execute arbitrary code on the GitLab server under certain conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the running GitLab version (sudo gitlab-rake gitlab:env:info or the Admin Area) and compare it to the affected ranges.
Upgrade to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1 or later, matching your release line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
This page as .md · .json · in your agent: get_signal("CVE-2026-110264")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.