GitLab released patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 on October 21, 2026, to address multiple security vulnerabilities. The company strongly recommends that all self-managed GitLab installations upgrade immediately.
The most critical vulnerability is CVE-2026-110264, an integer overflow issue in the Regular Expression Compiler affecting GitLab Community Edition and Enterprise Edition. According to GitLab’s security advisory, the flaw “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.” The vulnerability carries a CVSS score of 10.0, indicating critical severity. It affects all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. The flaw was reported by joaxcar through GitLab’s HackerOne bug bounty program.
Beyond the remote code execution issue, GitLab patched seven additional vulnerabilities ranging from CVSS scores of 4.3 to 8.2. CVE-2026-15723 addresses an improper authentication issue in OmniAuth-to-LDAP auto-linking that could allow account takeover, while CVE-2026-112212 involves cache poisoning in OAuth/OIDC discovery endpoints. Other fixes include improper access control in GraphQL, incomplete SAML/LDAP membership lock enforcement, internal credential exposure, authorization bypass in group milestones API, and issues related to AI Gateway feature enablement and merge request caching.
GitLab.com and GitLab Dedicated tenants are already running patched versions. For self-managed instances, GitLab security released threat detection capabilities to help identify exploitation attempts. The company notes that security fixes for vulnerabilities are made public on its issue tracker 90 days after the release in which they were patched, as part of its standard security disclosure practice.
Key facts
- GitLab released critical patch versions on October 21, 2026, addressing a remote code execution vulnerability
- CVE-2026-110264, an integer overflow in the Regular Expression Compiler, has a CVSS score of 10.0 and allows unauthenticated users to execute arbitrary code
- Eight total security vulnerabilities were patched, with CVSS scores ranging from 4.3 to 10.0
- The vulnerability affects all GitLab versions from 7.0 before the patched versions
- GitLab.com and GitLab Dedicated are already running patched versions