GitLab warns of max severity RCE flaw CVE-2026-110264

GitLab released security patches for a maximum-severity integer overflow in its Regular Expression Compiler that lets unauthenticated attackers execute arbitrary code on vulnerable servers. Fixes are available in CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com is already patched.

• CVE-2026-110264 is an integer overflow in the Regular Expression Compiler
• Patched versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13
• Shadowserver tracks over 2,700 GitLab CE instances exposed online
• The flaw was reported by researcher joaxcar via HackerOne