Vulnerabilities & Exploits

GitLab code-execution flaw reaches back to version 7.0

GitLab fixed 12 vulnerabilities in Community and Enterprise editions on October 21, including a critical unauthenticated code-execution flaw affecting releases dating to version 7.0, CERT-EU reported. The release also addresses two high-severity issues involving account takeover under specific SAML/LDAP settings and OAuth/OIDC discovery-cache poisoning.

The critical bug is an integer overflow—a number exceeding the range its storage can hold—while GitLab compiles a specially crafted regular expression. Under certain conditions, that parsing failure lets an unauthenticated attacker run code on the server. GitLab published detection rules for exploitation attempts, but installing a fix cannot establish whether an instance was already compromised.

For organizations running self-managed GitLab, especially on older branches, the flaw’s reach means current-branch inventories can miss exposure: each branch has its own corrected release. If a server was internet-facing, an upgrade closes the flaw but leaves open whether an attacker got in and affected the code and collaboration environment it hosts.

8 sources · 6h ago

CVE-2026-110264

NVD KEV

CVSS 10 CRITICAL: an issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10…

Timeline

Oct 22 Reported by The Register Security
Oct 21 Reported by The Hacker News

Sources

Oct 22 The Register Security
Max-severity GitLab bug allows remote code execution over 12 years of releases
Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'
original
Oct 22 CERT-SE
Kritisk sårbarhet i GitLab CE och EE - CERT-SE
Gitlab har publicerat säkerhetsuppdateringar för en ny sårbarhet, CVE-2026-110264.
original
Oct 22 BleepingComputer
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
original

Part of the PlainSec briefing for 2026-10-22

Every edition of this story: GitLab code-execution flaw reaches back to version 7.0

More from today

Vulnerabilities & ExploitsGitLab code-execution flaw reaches back to version 7.0GitLab fixed 12 vulnerabilities in Community and Enterprise editions on October 21, including a critical unauthenticated code-execution flaw affecting releases dating to version 7.0, CERT-EU reported. The release also addresses two high-severity issues involving account takeover under specific SAML/LDAP settings and OAuth/OIDC discovery-cache poisoning.The critical bug is an integer overflow—a number exceeding the range its storage can hold—while GitLab compiles a specially crafted regular expression. Under certain conditions, that parsing failure lets an unauthenticated attacker run code on the server. GitLab published detection rules for exploitation attempts, but installing a fix cannot establish whether an instance was already compromised.For organizations running self-managed GitLab, especially on older branches, the flaw’s reach means current-branch inventories can miss exposure: each branch has its own corrected release. If a server was internet-facing, an upgrade closes the flaw but leaves open whether an attacker got in and affected the code and collaboration environment it hosts.8 sources · 6h ago

CVE-2026-110264

NVD KEV

CVSS 10 CRITICAL: an issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10…

Timeline

Oct 22 Reported by The Register Security

Oct 21 Reported by The Hacker News

Sources

Oct 22 The Register Security

Max-severity GitLab bug allows remote code execution over 12 years of releases

Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'

original

Oct 22 CERT-SE

Kritisk sårbarhet i GitLab CE och EE - CERT-SE

Gitlab har publicerat säkerhetsuppdateringar för en ny sårbarhet, CVE-2026-110264.

original

Oct 22 BleepingComputer

GitLab warns of new max severity code execution vulnerability

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.

original

Part of the PlainSec briefing for 2026-10-22Every edition of this story: GitLab code-execution flaw reaches back to version 7.0More from today

PHP2Shell attempts surge as embedded-product fixes lag

Arista VeloCloud zero-day puts orchestration host at risk

Siemens signed launcher hides a trojanized installer