---
id: "CVE-2026-110264"
kind: "vulnerability"
aliases: ["CVE-2026-110264"]
title: "GitLab: crafted regular expression lets unauthenticated users run code on server"
severity: "critical"
cvss: 10.0
epss: 0.00505
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "poc-public", "gitlab", "self-hosted"]
not_affected_if: ["gitlab.com-managed-hosting", "version-outside-affected-ranges"]
published_at: "2026-10-22T01:16:57+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T19:08:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110264", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110264", "first_seen_at": "2026-10-24T07:15:52+00:00"}, {"source": "github-poc", "url": "https://github.com/googlesky/CVE-2026-110264", "first_seen_at": "2026-10-24T07:18:28+00:00"}, {"source": "github-poc", "url": "https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE", "first_seen_at": "2026-10-24T14:37:50+00:00"}, {"source": "github-poc", "url": "https://github.com/emirwtz/CVE-2026-110264", "first_seen_at": "2026-10-24T19:08:48+00:00"}]
---

# GitLab: crafted regular expression lets unauthenticated users run code on server

GitLab CE/EE has an integer overflow when compiling a specially crafted regular expression, across many versions from 7.0 up to the fixed releases. An unauthenticated attacker can execute arbitrary code on the GitLab server under certain conditions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the running GitLab version (sudo gitlab-rake gitlab:env:info or the Admin Area) and compare it to the affected ranges.

## Fix

Upgrade to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1 or later, matching your release line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110264
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110264
- 2026-10-24T07:18:28+00:00 github-poc https://github.com/googlesky/CVE-2026-110264
- 2026-10-24T14:37:50+00:00 github-poc https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE
- 2026-10-24T19:08:48+00:00 github-poc https://github.com/emirwtz/CVE-2026-110264

## Documents

- [poc] googlesky/CVE-2026-110264 https://github.com/googlesky/CVE-2026-110264
- [poc] Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE https://github.com/Masriyan/Exploit-CVE-2026-110264-GitLab-CE-EE-RCE
- [poc] emirwtz/CVE-2026-110264 https://github.com/emirwtz/CVE-2026-110264

## From the sources

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_