{"id":"CVE-2026-110264","kind":"vulnerability","aliases":["CVE-2026-110264"],"related":[],"title":"GitLab: crafted regular expression lets unauthenticated users run code on server","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","summary":"GitLab CE/EE has an integer overflow when compiling a specially crafted regular expression, across many versions from 7.0 up to the fixed releases. An unauthenticated attacker can execute arbitrary code on the GitLab server under certain conditions.","severity":"critical","cvss":10.0,"epss":0.00505,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","poc-public","gitlab","self-hosted"],"not_affected_if":["gitlab.com-managed-hosting","version-outside-affected-ranges"],"how_to_check":"Check the running GitLab version (sudo gitlab-rake gitlab:env:info or the Admin Area) and compare it to the affected ranges.","fix":"Upgrade to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1 or later, matching your release line.","status":"open","published_at":"2026-10-22T01:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:40+00:00","updated_at":"2026-10-24T19:08:48+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:32:40Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1 or later, matching your release line.","reach":"internet","title":"GitLab: crafted regular expression lets unauthenticated users run code on server","impact":"high","summary":"GitLab CE/EE has an integer overflow when compiling a specially crafted regular expression, across many versions from 7.0 up to the fixed releases. An unauthenticated attacker can execute arbitrary code on the GitLab server under certain conditions.","category":"runtime","who_cares":["gitlab","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated attacker runs arbitrary code on the GitLab server","analyst_note":"Sources do not say which conditions are required or whether exploitation needs a specific feature; check the GitLab advisory for the exact preconditions and the patched version list.","how_to_check":"Check the running GitLab version (sudo gitlab-rake gitlab:env:info or the Admin Area) and compare it to the affected ranges.","needs_analyst":true,"not_affected_if":["gitlab.com-managed-hosting","version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000539,"input_tokens":3016,"output_tokens":474,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110264':14A,17A '-2026':13A,16A '18.11.13':77C '19.0':78C '19.0.10':80C '19.1':81C '19.1.9':83C '19.2':84C '19.2.9':86C '19.3':87C '19.3.6':89C '19.4':90C '19.4.3':92C '19.5':94C '19.5.1':96C '7.0':43B,75C 'across':39B 'affect':71C 'allow':103C 'arbitrari':54B,109C 'attack':51B 'ce/ee':27B,70C 'certain':61B,99C 'code':9A,55B,110C 'compil':33B,120C 'condit':62B,100C 'could':101C 'craft':2A,36B,123C 'cve':12A,15A 'discov':67C 'due':115C 'execut':53B,108C 'express':4A,38B,125C 'fix':47B 'gitlab':1A,22B,26B,58B,69C,113C 'host':25B 'integ':30B,117C 'issu':64C 'let':5A 'mani':40B 'overflow':31B,118C 'poc':20B 'poc-publ':19B 'public':21B 'regular':3A,37B,124C 'releas':48B 'run':8A 'runtim':18B 'self':24B 'self-host':23B 'server':11A,59B,114C 'special':35B,122C 'unauthent':6A,50B,105C 'user':7A,106C 'version':41B,73C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":3,"sources":[{"source":"nvd","external_id":"CVE-2026-110264","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","severity":null,"published_at":"2026-10-22T01:16:57+00:00","modified_at":"2026-10-22T23:18:22+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110264","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110264","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null},{"source":"github-poc","external_id":"googlesky/CVE-2026-110264","url":"https://github.com/googlesky/CVE-2026-110264","severity":null,"published_at":"2026-10-24T07:11:16+00:00","modified_at":null,"first_seen_at":"2026-10-24T07:18:28+00:00","fetched_at":"2026-10-24T07:18:28+00:00","note":null},{"source":"github-poc","external_id":"Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE","url":"https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE","severity":null,"published_at":"2026-10-24T14:23:32+00:00","modified_at":null,"first_seen_at":"2026-10-24T14:37:50+00:00","fetched_at":"2026-10-24T14:37:50+00:00","note":null},{"source":"github-poc","external_id":"emirwtz/CVE-2026-110264","url":"https://github.com/emirwtz/CVE-2026-110264","severity":null,"published_at":"2026-10-24T19:06:47+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:08:48+00:00","fetched_at":"2026-10-24T19:08:48+00:00","note":null}],"documents":[{"id":2708,"url":"https://github.com/googlesky/CVE-2026-110264","title":"googlesky/CVE-2026-110264","kind":"poc","source":"github","text":"PoC, reproducible labs, live evidence, Nuclei fingerprint, and technical report for CVE-2026-110264 — GitLab Org-mode/Onigmo unauthenticated RCE (CVSS 10.0); render oracle validated on GitLab CE 19.3.1.\n\nstars 0","published_at":"2026-10-24T07:11:16+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2774,"url":"https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE","title":"Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-24T14:23:32+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":2918,"url":"https://github.com/emirwtz/CVE-2026-110264","title":"emirwtz/CVE-2026-110264","kind":"poc","source":"github","text":"Non-invasive Python detector for CVE-2026-110264 in GitLab, featuring version checks, offline log analysis, and JSON reporting.\n\nstars 0","published_at":"2026-10-24T19:06:47+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}