GitLab patches a critical flaw that lets unauthenticated attackers run code on self-managed servers, affecting every release since 7.0 in 2014 (Swati Khandelwal/The Hacker News)

A critical vulnerability affecting GitLab's software across 12 years of releases has been identified. This flaw, tracked as CVE-2026-110264, could allow unauthenticated users to execute arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression. The vulnerability, rated 10.0 on the CVSS scale, is the highest possible rating.

GitLab fixed the flaw in seven versions simultaneously, but the fix mattered even for administrators who had previously patched their systems. The new fixed versions are one patch above the previously covered versions. Only self-managed installations need to act, as GitLab.com and GitLab Dedicated tenants on specific internal releases already have the fix.

GitLab has not reported any known exploitation of the flaw. The vulnerability exists in the Ruby built-in engine, Onigmo, which GitLab ships and patches in its own builds. The regular-expression compiler's weakness is present in every release since 7.0. GitLab has published two detection rules to help administrators identify potential exploitation attempts.

This is the fourth code-execution flaw in GitLab's regular-expression engine reported by the same researcher in a short period, and the first to reach versions prior to 19.2.