GitLab patches a CVSS 10.0 flaw that lets attackers run code without logging in
GitLab CVSS 10.0 Integer Overflow issue
GitLab shipped emergency patch releases after disclosing CVE-2026-110264, a CVSS 10.0 integer overflow in its regular expression compiler that could let an unauthenticated attacker execute arbitrary code on a GitLab server. The flaw affects every version since 7.0, so the fix was backported across nine release lines. The same batch closes eleven more holes, including an LDAP account takeover and an OAuth/OIDC cache poisoning bug, and adds detections for exploitation attempts.
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.