Integer Overflow Vulnerability in GitLab CE/EE Affects Multiple Versions
CVE-2026-110264

10CRITICAL

Key Information:

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 22 October 2026

Badges

📈 Trended📈 Score: 292,000💰 Ransomware👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-110264?

CVE-2026-110264 is an integer overflow vulnerability found in multiple versions of GitLab Community Edition (CE) and Enterprise Edition (EE), a web-based DevOps lifecycle tool that provides capabilities for Source Code Management (SCM) and Continuous Integration/Continuous Deployment (CI/CD). This vulnerability arises due to improper handling of specially crafted regular expressions, which allows an unauthenticated user to potentially execute arbitrary code on the GitLab server. The affected versions range from as early as 7.0 to specific releases prior to 19.5.1, making it a critical issue for organizations that utilize GitLab for project management and software development. With this vulnerability, attackers could gain unauthorized access and control over critical systems, significantly impacting the security posture of affected organizations.

Potential impact of CVE-2026-110264

Remote Code Execution: The vulnerability enables unauthenticated users to execute arbitrary code on the GitLab server, which can lead to full system compromise if exploited successfully. This level of access could allow attackers to manipulate repositories, modify sensitive configurations, and disrupt ongoing development processes.
Data Breaches: With the ability to execute arbitrary code, attackers could exfiltrate sensitive data from the GitLab instances, including intellectual property, proprietary code, and personal information of users, leading to significant reputational and financial damage for organizations.
Increased Attack Surface: The existence of this vulnerability may encourage other malicious actors to probe for weaknesses in GitLab installations, increasing the likelihood of ransomware or other exploit campaigns targeting organizations that fail to mitigate the risks associated with this vulnerability promptly.

Affected Version(s)

GitLab 7.0 < 18.11.13

GitLab 19.0 < 19.0.10

GitLab 19.1 < 19.1.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2026-110264-gitlab-regex-rce
Created by Ghost-Bx1

go-gitlab-cve-2026-110264-scanner
Created by xaviware

onigmo-cve-2026-110264
Created by lesterlam

News Articles

Dev Community

CVE-2026-110264 CVE-2026-97229

GitLab's Unauthenticated RCE: Check, Patch and Verify in 10 Minutes

Self-managed GitLab before 19.5.1 carries a CVSS 10 unauthenticated RCE. Check your version, upgrade to the fixed release, and verify it in 10 minutes. Tagged with gitlab, security, devops.

1 week ago