Cybersecurity
GitLab patches critical code execution flaw
GitLab issued fixes for a critical Regular Expression Compiler flaw that could let unauthenticated attackers run code on vulnerable servers, and said customers should upgrade affected CE and EE releases immediately.
- GitLab said CVE-2026-110264 affected its Regular Expression Compiler and could let an unauthenticated attacker run code on a vulnerable server under certain conditions.
- The issue was reported by a researcher using the joaxcar handle through GitLab's HackerOne bug bounty programme.
- GitLab fixed CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and said GitLab.com and some GitLab Dedicated tenants were already patched.
- Shadowserver said it tracked more than 2,700 exposed GitLab CE instances online, and the article noted earlier GitLab flaws CVE-2026-97229 and CVE-2026-85706, which the U.S. Cybersecurity and Infrastructure Security Agency later added to its actively exploited list.
GitLab said it had patched CVE-2026-110264 in its Regular Expression Compiler. It said an unauthenticated attacker could execute code on a server if the compiler processed a specially crafted regular expression.
The company said joaxcar reported the flaw through HackerOne. It fixed CE and EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and told users to install updates quickly.
GitLab said GitLab.com already had the patch, and certain GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later did not need action. The article also said Shadowserver tracked more than 2,700 GitLab CE instances exposed online.
It also said GitLab had warned about CVE-2026-97229 ten days earlier and had fixed CVE-2026-85706 last month. One day later, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-85706 to its list of actively exploited flaws and told federal agencies to secure their systems within three days.
Named in this story
People
- joaxcar
- reported the issue through GitLab's bug bounty programme
Companies
- GitLab
- released the fix and urged customers to upgrade
Organisations
- HackerOne
- handled the bug bounty submission
- Shadowserver
- tracked exposed GitLab CE instances online
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added CVE-2026-85706 to its actively exploited list and set a three-day deadline
Products and systems
- CVE-2026-110264
- identifier for the new vulnerability
- Regular Expression Compiler
- component with the integer overflow flaw
- GitLab Community Edition
- affected product line with patched releases
- GitLab Enterprise Edition
- affected product line with patched releases
- GitLab.com
- was already running the patched version
- GitLab Dedicated
- had certain tenant versions already fixed
- CVE-2026-97229
- another critical GitLab RCE flaw warned about ten days earlier
- CVE-2026-85706
- another maximum-severity GitLab flaw fixed last month
How the source tells it
Mostly a straight security bulletin, but it mixed urgent patch guidance with reassurance for hosted customers and a promotional close for GitLab's wider platform.
- urgency imperative patch-now language and a call to upgrade as soon as possible
- reassurance status note that hosted GitLab services were already fixed or exempt
- vendor boosterism self-promotional user-count and Fortune 100 claims followed by a report plug