GitLab has released fixes for a maximum-severity vulnerability in its regular expression compiler that could let an unauthenticated attacker run code on the server. The flaw, CVE-2026-110264, comes from an integer overflow when a specially crafted expression is processed. Fixed Community and Enterprise versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and GitLab.com has already been updated. It is the second critical flaw in the same component within ten days.

What it means: Many Greek software companies, universities and public bodies run their own GitLab, because they want code and pipelines inside their own infrastructure. That advantage comes at a price: responsibility for patching on time rests entirely with the administrator. A flaw that allows code execution without logging in, on the server that holds source code, pipeline secrets and keys to production environments, is one of the worst scenarios a development team can face. The practical move is to upgrade immediately and to ask whether the instance really needs to be reachable from the internet. Access through a VPN or an identity-aware gateway is often enough and sharply reduces exposure to flaws like this one. Since this is the second critical issue in the same component in a short time, researchers are clearly examining that area closely, so further fixes are likely and a steady process for quick upgrades is essential. For teams without the resources to keep up, moving to the hosted service may be safer than a server that falls behind on versions.

Read the original on BleepingComputer

Related service: Custom software

Related stories