GitLab patches critical flaw in older versions
A vulnerability with the maximum severity score has affected self-managed GitLab installations since 2014.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
GitLab released security updates on Wednesday for a critical flaw that could, under certain conditions, allow an unauthenticated attacker to execute code on a server. The problem affects self-managed installations and received the maximum CVSS score of 10.0.
GitLab published patches for Community Edition and Enterprise Edition on 21 October. The company is urging administrators to update their self-managed installations as soon as possible to one of the new versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
The vulnerability, registered as CVE-2026-110264, occurs when compiling a specially crafted regular expression. An integer overflow can, under certain circumstances, allow arbitrary code to be executed on the GitLab server. GitLab has not disclosed precisely which additional conditions are required for this.
According to GitLab, the flaw affects all versions from 7.0 onwards that are older than the patched versions listed above. This means the problem dates back to a software branch released in 2014. GitLab has therefore backported the fix for older versions, even though those versions are outside the usual support period.
The warning does not apply to GitLab.com users: according to GitLab, that infrastructure is already running a patched version. GitLab Dedicated environments with certain internal versions should also already contain the fix. Organisations running GitLab on their own servers or in their own cloud environments in particular should check which version is active.
GitLab has also published two detection rules that administrators can use to search log files for possible exploitation attempts. The European cybersecurity service CERT-EU advises organisations to prioritise internet-accessible installations and investigate whether systems may have been compromised.
According to The Hacker News, there was no public evidence on 22 October that this specific vulnerability had already been used in attacks. That does not mean older installations are safe without an update: GitLab says there is no temporary workaround that offers the same assurance as patching.
An upgrade can affect operations. For some versions, database migrations form part of the process; on single-node systems, this can cause temporary downtime. According to GitLab, installations with multiple nodes can, under certain conditions, be updated without interruption.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The core claims were directly confirmed by GitLab and CERT-EU. The context concerning possible exploitation, scope and the consequences of the update was checked against an independent technical source.
- confirmed GitLab released security updates for multiple CE and EE versions on 21 October 2026. — GitLab gives the release date and version numbers in the patch note. source
- confirmed CVE-2026-110264 can, under certain conditions, enable code execution without authentication. — GitLab describes the flaw as an integer overflow when compiling a specially crafted regular expression. source
- confirmed The vulnerability has a CVSS score of 10.0. — The score appears in GitLab's official security notice. source
- confirmed The problem affects versions from GitLab 7.0 onwards. — GitLab lists the affected version series from 7.0 onwards. source
- confirmed GitLab.com is already running a patched version. — GitLab says that GitLab.com is already running the patched version. source
- confirmed CERT-EU advises organisations to prioritise updating internet-accessible installations. — CERT-EU gives this advice in its security warning of 22 October. source
- confirmed There was no public evidence on 22 October that this specific vulnerability had been exploited. — The Hacker News reports that GitLab had not reported any exploitation and that the flaw was not in the CISA catalogue. source
- confirmed Some updates can cause temporary downtime because of database migrations. — GitLab warns of downtime for certain single-node installations. source
Editor's note
It is certain that GitLab released patches on 21 October, which versions are affected and that the vulnerability received a CVSS score of 10.0. There is no public evidence that this specific flaw has been exploited; the precise exploitation conditions have not been disclosed.Sources
More on this in Dutch media
- Tweakers — „gitlab cybersecurity”
- AD — „gitlab cybersecurity”
- RTL Nieuws — „gitlab cybersecurity”