GitLab has released security patches for a very severe flaw in the Regular Expression Compiler. The vulnerability allows attackers to remotely execute arbitrary code.
According to BleepingComputer, the vulnerability is registered as CVE-2026-110264 and was reported through GitLab’s HackerOne bug bounty program. The vulnerability stems from an integer overflow in GitLab’s Regular Expression Compiler. This is a background engine that parses and validates regular expressions in configuration files.
GitLab has fixed the vulnerability in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 of GitLab Community Edition (CE) and Enterprise Edition (EE). Administrators should patch their instances immediately.
“We have fixed an issue that could have allowed an unauthenticated user, under certain circumstances, to execute arbitrary code on the GitLab server due to an integer overflow when compiling a specially crafted regular expression,” GitLab reports.
“We strongly recommend that all installations running a version affected by the issues described below be upgraded to the latest version as soon as possible. [..] GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes. Administrators of these environments do not need to take any action.”
The security organization Shadowserver currently tracks more than 2,700 GitLab Community Edition instances that are accessible via the internet. However, it does not indicate how many of these are honeypots or have already been secured against attacks.
GitLab regularly reports vulnerabilities
Ten days ago, GitLab warned customers about another critical remote code execution vulnerability (CVE-2026-97229) with a CVSS base score of 10/10 in the CI/CD Regular Expression Compiler. Both vulnerabilities were reported by security researcher “joaxcar.”
Last month, the company patched another critical GitLab CE/EE vulnerability (CVE-2026-85706) that allowed unauthenticated attackers to read sensitive data, including login credentials and other confidential information, from vulnerable servers.
A day later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its list of actively exploited vulnerabilities and directed federal agencies to secure their systems within three days.
Since November 2021, CISA has identified five GitLab vulnerabilities being exploited in the wild, including one that was used in ransomware attacks.