Critical GitLab vulnerability allows remote code execution

GitLab has announced the patching of a critical vulnerability that could allow unauthenticated attackers to execute arbitrary code on self-managed servers. This flaw, tracked as CVE-2026-110264, affects both GitLab Community Edition (CE) and Enterprise Edition (EE) versions starting from version 7.0, released in June 2014.

The issue stems from an integer overflow occurring during regular expression compilation, meaning that an unauthenticated user could potentially execute code on the GitLab server under certain conditions. This situation poses a significant risk to data security and system integrity for those using older versions of the software.

GitLab has released fixes in versions 19.5.1, 19.4.3, and 19.3.6, and has backported the patch to versions 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The company has urged all users to upgrade immediately to safeguard their systems from potential attacks.

## Why it matters The existence of this vulnerability for over a decade highlights the importance of keeping software up to date, especially on platforms handling critical information. The potential for remote code execution by attackers can lead to devastating consequences, including data loss and security breaches.

## What we know The vulnerability has been confirmed, and patches have been provided for the affected versions. GitLab has emphasized the urgency of implementing these updates to avoid unnecessary risks.

## What remains unclear It is still unclear if specific incidents related to this vulnerability have been reported or if it was exploited before the patch disclosure. Additionally, the measures users should take to mitigate risks if they cannot update immediately are not yet known.