GitLab warns of another max-severity flaw. No login needed to run code.
By Lior AharonovFounder, 7IT Solutions ·
What happened
GitLab released 19.5.1 and backports on 22 October 2026 for CVE-2026-110264, an integer overflow in its regular expression compiler. GitLab says an unauthenticated user could run arbitrary code on the server under certain conditions. BleepingComputer does not report exploitation and says GitLab.com already runs the fix.
Why it matters
Your repositories, CI runners and deploy tokens sit on that server. GitLab warned of a 10 out of 10 code execution flaw only ten days earlier. This fix ships only in the 22 October releases.
What to do
If you self-manage GitLab, upgrade today to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, whichever matches your line.
Two maximum-severity warnings in ten days. Patch day is now every week.
Lior Aharonov · my takeSources
| GitLab warns of new max severity code execution vulnerability (BleepingComputer) | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.