GitLab releases critical security patches for remote code execution vulnerability

GitLab has released several critical security patches to address 12 vulnerabilities, including a high-severity issue identified as CVE-2026-110264. This specific vulnerability involves an integer overflow in the Regular Expression Compiler, which could allow an unauthenticated user to execute arbitrary code on a GitLab server under certain conditions.

The vulnerability affects a wide range of GitLab Community Edition (CE) and Enterprise Edition (EE) versions, potentially spanning back to version 7.0. GitLab has released several patched versions, including 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The company strongly recommends that all self-managed installations upgrade to these versions immediately to maintain security hygiene.

GitLab reported that there is currently no evidence that CVE-2026-110264 has been exploited in the wild, and it is not listed on the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog. Other addressed issues include an improper authentication flaw in OmniAuth-to-LDAP email lookup.