GitLab Releases Critical Patch for Integer Overflow Vulnerability (CVE-2026-110264)

Critical Patch Release Issued

On October 21, 2026, GitLab released several critical patch versions for both GitLab Community Edition (CE) and Enterprise Edition (EE). The released versions include 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. These updates contain important bug and security fixes.

Vulnerability Details

The primary security fix addresses CVE-2026-110264, an integer overflow issue in the Regular Expression Compiler. This vulnerability could allow an unauthenticated user to execute arbitrary code on the GitLab server by compiling a specially crafted regular expression. The issue impacts GitLab CE/EE versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, and 19.3 before 19.3.6.

Upgrade Recommendation

GitLab strongly recommends that all self-managed GitLab installations be upgraded to one of the new patch versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not require action. The fix has been backported to multiple older supported versions to ensure broader coverage.

Security Disclosure Policy

GitLab follows a policy of making vulnerability details public on its issue tracker 90 days after the release in which they were patched. This allows users time to upgrade before full details of the exploits are widely known.