GitLab Addresses Critical Flaw Allowing Code Execution
GitLab recently released patches for a critical vulnerability that could allow an attacker to execute code on a self-managed server without the need for authentication. This flaw impacts all versions of the software dating back to 2014, with the fix covering a broader range of versions than initially addressed.
Referred to as CVE-2026-110264, the vulnerability is rated at the maximum score of 10.0 on the CVSS scale. GitLab warns that under specific circumstances, an unauthenticated user could exploit an integer overflow during the compilation of a specially crafted regular expression to run arbitrary code on the server.
While there is no evidence of the vulnerability being actively exploited, GitLab urges self-managed installations to apply the necessary patches. The company has already integrated the fix into GitLab.com and dedicated tenants on specific internal releases.
Key Points:
- The critical flaw in GitLab’s regular-expression engine affects versions dating back to 2014.
- The company backported the fix to older versions outside of its standard patching policy due to the severity of the issue.
- GitLab has published detection rules to help administrators identify potential exploitation attempts.
Administrators are advised to upgrade to the patched versions to mitigate the risk of exploitation. GitLab has not disclosed the specific conditions required for an attacker to reach the compiler, emphasizing the importance of applying the fix as the primary safeguard.
It is worth noting that this is the fourth code-execution flaw in GitLab’s regular-expression engine reported by the same researcher in recent weeks, highlighting the importance of staying vigilant against such vulnerabilities.
Aside from addressing the critical code-execution flaw, the latest release includes fixes for multiple security issues, ranging from high to low severity. Administrators are encouraged to plan for the upgrade process, especially for servers with single-node setups that may experience downtime during the database changes.
