GitLab patches a second CVSS 10.0 regex RCE (CVE-2026-110264)

GitLab shipped patches on October 21 for CVE-2026-110264, a CVSS 10.0 flaw that lets an unauthenticated user run arbitrary code on a self-managed server. The fix is in the 18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1 patch release. If that description feels familiar, it should: this is the second maximum-severity integer-overflow RCE in GitLab's regex compiler this month.

What the bug does

Per GitLab's release notes, CVE-2026-110264 is an integer overflow that occurs when GitLab compiles a specially crafted regular expression, and "an unauthenticated user could potentially execute arbitrary code on the GitLab server." GitLab has not said what the "certain conditions" are.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network, no privileges, no user interaction, scope-changed. That is the same vector, and the same 10.0 ceiling, as CVE-2026-97229, which GitLab patched on October 12.

Affected versions

Every release back to 7.0 (2014) is affected. The first fixed version on each maintained branch:

• 7.0 through 18.11, before 18.11.13
• 19.0 before 19.0.10
• 19.1 before 19.1.9
• 19.2 before 19.2.9
• 19.3 before 19.3.6
• 19.4 before 19.4.3
• 19.5 before 19.5.1

GitLab.com already runs the fix. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0, or later are covered. The exposure is on self-managed instances. The same release also resolved eleven lower-severity issues, including a high-severity LDAP account-takeover (CVE-2026-15723) and OAuth/OIDC cache poisoning (CVE-2026-112212).

Exploitation status

GitLab says it has no indication the flaw was used in attacks, and it was not in CISA's Known Exploited Vulnerabilities catalog at publication. There is no public PoC and no interim workaround — upgrading is the only protection GitLab offers.

Action checklist

1. Upgrade to the first fixed version on your branch. This is a same-day job for any self-managed instance reachable from the internet.
2. If you patched on October 12, you may still be exposed. The October 12 release covered only 19.2, 19.3, and 19.4; the new fixed versions sit one patch above it, and it back-ported nothing to 18.11, 19.0, or 19.1. Instances on those older branches had no fix until today.
3. Prioritize instances that parse untrusted input — public projects, open registration, anything where an outsider can influence a request that reaches the regex path.
4. If you cannot patch now, put the web front end behind authentication or an allowlist.
5. Review job logs and runner activity on exposed instances for unexpected command execution since the release.

Context

Two CVSS 10.0 regex-compiler RCEs in nine days is not a coincidence. When we covered CVE-2026-97229 on October 12, we called the CI/CD regex compiler "a recurring soft spot … being hardened release by release." CVE-2026-110264 is the next round of that hardening — a related overflow the first patch did not close, found in the same code path, and this time back-ported across a decade of releases. The regex compiler parses attacker-influenced input on a server that holds source, secrets, and deploy keys. Treat the parser path as hostile and keep the patch cadence tight; expect more from this corner of the codebase.