GitLab Fixes CVSS 10.0 Critical Flaw Affecting Versions from Around 2012
On October 21, 2026, GitLab released a patch for CVE-2026-110264, which has a CVSS 3.1 score of 10.0. Under certain conditions, attackers could exploit an integer overflow to execute arbitrary code when compiling specially crafted regular expressions. The vulnerability affects older versions of CE/EE starting from 7.0, reportedly spanning a period of about 12 years.
GitLab Fixes Flaw with a Perfect CVSS Score of 10.0, Affecting Versions Spanning Approximately 12 Years
On October 21, 2026, GitLab released a patch to fix CVE-2026-110264, which has a CVSS 3.1 score of 10.0. Under certain conditions, an attacker could exploit an integer overflow to execute arbitrary code when compiling a specially crafted regular expression.
The affected range includes older versions of CE/EE starting from 7.0, reportedly spanning about 12 years. The official recommendation is for self-hosted instances to upgrade to patched versions such as 18.11.13, 19.0.10, and 19.1.9. GitLab.com is already running a patched version.
Source: GitLab