GitLab issues urgent fix for critical regex compiler flaw
GitLab patched a maximum-severity integer overflow in its Regular Expression Compiler, tracked as CVE-2026-110264, that could allow unauthenticated remote attackers to execute arbitrary code. Fixes are available in multiple Community Edition and Enterprise Edition releases, while GitLab.com is already running the patched version. Shadowserver tracks more than 2,700 internet-exposed GitLab Community Edition instances.
The bug, CVE-2026-110264, arises when GitLab’s regex compilation engine handles a specially built pattern, producing an integer overflow that can be exploited without login. A researcher credited as joaxcar reported it through GitLab’s HackerOne program.
Patched releases span CE and EE from 18.11.13 through 19.5.1, with GitLab.com already updated and certain Dedicated tenants covered. Shadowserver counts more than 2,700 exposed CE instances, though it does not say how many are honeypots or already fixed.
Organizations relying on self-managed GitLab CE or EE may face elevated risk until upgrades are applied, especially where instances are internet-facing. A successful exploit could let an outside party run code on a server, potentially affecting source code, build workflows, and connected systems. GitLab.com users are already covered, but smaller teams and public-sector deployments may lag, so prompt patching could reduce broader disruption.