GitLab released fixes on 21 October for CVE-2026-110264, a flaw rated 10.0 that can let an unauthenticated attacker run arbitrary code on a self-managed server through an integer overflow during compilation of a specially crafted regular expression. The vulnerability affects every release of the software going back to version 7.0 in 2014, and the fix matters even for administrators who patched nine days earlier: the 12 October update covered only versions 19.2 and later, and the new fixed releases sit one patch above it, placing an instance updated then back in range. GitLab shipped fixes across seven versions at once, including 19.5.1, 19.4.3 and 19.3.6, and says GitLab.com and current GitLab Dedicated tenants already run fixed code. The company reports no sign the flaw has been exploited, and it is not in the CISA known-exploited-vulnerabilities catalogue.

• Source article