{
  "id": 15942897,
  "title": "Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases",
  "url": "https://urgent.news/2026/10/21/critical-gitlab-flaw-cvss-10-0-could-allow-unauthenticated-rce-across",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T18:57:34.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html"
  },
  "original_language": "en",
  "account": "A critical vulnerability affecting GitLab's software across 12 years of releases has been identified. This flaw, tracked as CVE-2026-110264, could allow unauthenticated users to execute arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression. The vulnerability, rated 10.0 on the CVSS scale, is the highest possible rating. GitLab fixed the flaw in seven versions simultaneously, but the fix mattered even for administrators who had previously patched their systems. The new fixed versions are one patch above the previously covered versions. Only self-managed installations need to act, as GitLab.com and GitLab Dedicated tenants on specific internal releases already have the fix. GitLab has not reported any known exploitation of the flaw. The vulnerability exists in the Ruby built-in engine, Onigmo, which GitLab ships and patches in its own builds. The regular-expression compiler's weakness is present in every release since 7.0. GitLab has published two detection rules to help administrators identify potential exploitation attempts. This is the fourth code-execution flaw in GitLab's regular-expression engine reported by the same researcher in a short period, and the first to reach versions prior to 19.2.",
  "summary": "GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}