GitLab patches maximum-severity code execution flaw in its regex compiler
Self-managed administrators on the affected releases need to upgrade, since over 2,700 Community Edition instances are publicly visible.
GitLab has shipped patches for CVE-2026-110264, a maximum-severity flaw in its Regular Expression Compiler that could let an unauthenticated remote attacker run arbitrary code on a GitLab server. The bug is an integer overflow triggered by a specially crafted regular expression, and it was reported through HackerOne by a researcher using the handle 'joaxcar'. Fixed releases cover Community and Enterprise Editions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and administrators are urged to upgrade as soon as possible. GitLab.com already runs the patched version, and GitLab Dedicated tenants on the listed internal builds are covered. The disclosure follows a separate critical CI/CD remote code execution flaw, CVE-2026-97229, reported by the same researcher ten days earlier, and Shadowserver counts over 2,700 publicly exposed GitLab Community Edition instances.
Why it matters
The flaw lets an unauthenticated remote attacker run code on a GitLab server, which places any self-hosted instance that has not been upgraded at direct risk. GitLab.com and GitLab Dedicated tenants on the listed builds are already covered, so the exposure falls mainly on organisations that run their own GitLab installations. The disclosure is the second serious remote code execution report from the same researcher in ten days, which makes the self-hosted patch gap the main concern.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BleepingComputer