GitLab 19.5.1 fixes a CVSS 10.0 code-execution flaw

GitLab released patches on October 21, 2026 for CVE-2026-110264, a flaw rated 10.0, the maximum on the CVSS severity scale. A bug in GitLab's regular expression compiler could let an attacker with no account run code on a GitLab server. GitLab.com is already patched, but every self-managed installation needs an upgrade.

What the flaw is

A regular expression, or regex, is a pattern used to search and match text. GitLab compiles these patterns into instructions before running them. In this case the compiler suffers an integer overflow: a number grows past what its storage can hold and wraps around, which can corrupt memory.

According to the GitLab patch release, a specially crafted regex triggers the overflow. That "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server." The flaw affects both Community Edition and Enterprise Edition, going back to GitLab 7.0.

The attack works over the network, needs no privileges and no user interaction, GBHackers reports. A researcher known as joaxcar reported it through GitLab's HackerOne bug bounty program. No source reports attacks in the wild or a public exploit. GIGAZINE notes the bug is not on CISA's list of known exploited vulnerabilities.

Which versions fix it

GitLab patched seven release lines at once:

Release line	Fixed version
19.5	19.5.1
19.4	19.4.3
19.3	19.3.6
19.2	19.2.9
19.1	19.1.9
19.0	19.0.10
18.11	18.11.13

The four oldest lines received the fix for CVE-2026-110264 as a backport. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later already have the fixes.

The other 11 fixes

The release fixes 12 vulnerabilities in total: one critical, two high, five medium and four low. All 12 are fixed in 19.3.6, 19.4.3 and 19.5.1.

The two high-severity bugs matter for teams with single sign-on. CVE-2026-15723, rated 8.2, is an authentication flaw in OmniAuth-to-LDAP auto-linking, but only when both SAML and LDAP auto-linking are turned on. CVE-2026-112212, rated 7.5, allows cache poisoning on OAuth and OpenID Connect discovery endpoints.

A busy month for GitLab security

This is not GitLab's first critical patch in October. Ten days earlier, GitLab warned of CVE-2026-97229, another 10.0 flaw in its CI/CD regex compiler, BleepingComputer reports. GIGAZINE says that October 12 patch covered 24 issues, and servers with only that patch are still exposed to the new bug.

BleepingComputer also cites Shadowserver, which tracks more than 2,700 GitLab CE instances reachable from the internet. That counts exposure, not confirmed attacks.

GitLab's advice is blunt: "we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately."

What this means for developers

A self-hosted GitLab server holds a company's source code and CI secrets, so a no-login code-execution bug is as serious as it gets.

• Upgrade today, and plan the downtime. 19.3.6 and 19.4.3 include database migrations. Single-node installs need downtime while they run, while multi-node setups can use GitLab's zero-downtime procedure.
• Move off the oldest branches. GitLab lists the full set of 12 fixes only for 19.3.6 and later. The older lines, 18.11.13 through 19.2.9, are named for the critical fix.
• Check for signs of attack. GitLab published two detections for self-managed instances, onigmo_native_worker_crash and org_mode_render_error_burst. Search your logs for them.
• Shrink the exposure. If your GitLab does not need to be on the public internet, put it behind a VPN or a single sign-on gateway.
• Rotate secrets if in doubt. A compromised GitLab server exposes CI/CD variables and deploy keys. If you find signs of a breach, rotate them all.