CRITICAL 10.0 NVD
CVE-2026-110264
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
- https://gitlab.com/gitlab-org/gitlab/-/work_items/633633
- https://hackerone.com/reports/4093475
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-10-22 via NVD.
Risk Timeline
CVE Disclosed2026-10-22 · -1 days ago
Remediation Resources
Analysis & PoC
gitlab.com/gitlab-org/gitlab/-/work_items/633633Analysis & PoC
hackerone.com/reports/4093475
vulnfeed aggregates 18809 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.