GitLab urges users to patch a critical code execution flaw spanning twelve years of releases

GitLab released emergency security updates on Wednesday to fix a maximum-severity flaw that allows unauthenticated attackers to remotely execute arbitrary code on self-managed servers. Tracked as CVE-2026-110264 with a maximum CVSS rating of 10, the vulnerability impacts Community Edition and Enterprise Edition versions dating as far back as GitLab 7.0 from June 2014. The company resolved the issue in versions 19.5.1, 19.4.3, and 19.3.6, while backporting fixes to releases 19.2.9, 19.1.9, 19.0.10, and 18.11.13. [1][2]

The bug was discovered by researcher Johan Carlsson through GitLab's HackerOne bug bounty program. It stems from an integer overflow weakness within the background engine that parses and compiles regular expressions. While GitLab.com and GitLab Dedicated environments are already patched, organizations running self-managed instances must upgrade immediately. Threat-detection firm SOC Prime warned that compromising these servers could expose CI/CD pipelines, deployment secrets, access tokens, and direct connections to production systems. [1][2]

Although no active attacks have been detected yet, cybersecurity monitoring group Shadowserver tracks more than 2,700 GitLab Community Edition instances exposed to the internet. Security experts anticipate swift scanning by attackers, pointing to another critical GitLab flaw patched last month that drew active exploitation within days and prompted emergency defense orders from the U.S. Cybersecurity and Infrastructure Security Agency. [1][2]