GitLab patches maximum severity flaw enabling server code execution

GitLab has issued patches for a maximum-severity code execution vulnerability described as an integer overflow in its Regular Expression Compiler, a background engine that parses and validates regular expressions in configuration files. The flaw, tracked as CVE-2026-110264, could allow an unauthenticated attacker to run arbitrary code on vulnerable GitLab servers when a specially crafted regular expression is compiled. The issue was reported by a security researcher using the HackerOne handle joaxcar through GitLab’s bug bounty programme.

GitLab says the vulnerability could under certain conditions enable code execution on the server, and has remediated it in GitLab Community Edition (CE) and Enterprise Edition (EE) releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The company urged affected users to apply the patches promptly. The report notes the flaw stems from an integer overflow within the Regular Expression Compiler, which processes expressions in configuration files.

BleepingComputer is cited as noting the patch release details, while the original report attributes the vulnerability to the researcher via GitLab’s HackerOne programme.