GITLAB released security updates on 21 October 2026 for 12 vulnerabilities affecting Community Edition (CE) and Enterprise Edition (EE). The most serious, CVE-2026-110264, has a CVSS score of 10.0. Researcher joaxcar reported an integer overflow in the regular expression compiler that could let an unauthenticated attacker execute code on a vulnerable server by submitting a specially crafted regular expression.
GitLab also fixed CVE-2026-15723 (CVSS 8.2), an LDAP injection flaw that could allow an authenticated attacker to take over existing LDAP-backed accounts when SAML and LDAP auto-linking are both enabled, and CVE-2026-112212 (CVSS 7.5), which could let an unauthenticated attacker redirect OAuth/OIDC authentication flows through cache poisoning.
The other nine flaws include access-control weaknesses and information leaks. GitLab said the issues were reported by researchers through HackerOne and by its internal security teams. No active exploitation of the 12 vulnerabilities has been confirmed, and the article reports no public proof of concept. GitLab.com and GitLab Dedicated tenants on versions 19.3.5-internal0 and 19.4.2-internal0 or later are already protected, according to the company’s advisory.
Patches are available in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. CVE-2026-110264 affects specified releases from version 7.0 up to those fixes; the other flaws affect various branches from version 10.1. GitLab advises self-managed administrators to upgrade to the corresponding patched release. The article also recommends watching for Onigmo native worker crashes or bursts of Org mode rendering errors in server logs.