Vulnerabilities · 5h ago

GitLab code-execution flaw reaches back to version 7.0

GitLab fixed 12 vulnerabilities in Community and Enterprise editions on October 21, including a critical unauthenticated code-execution flaw affecting releases dating to version 7.0, CERT-EU reported. The release also addresses two high-severity issues involving account takeover under specific SAML/LDAP settings and OAuth/OIDC discovery-cache poisoning.

The critical bug is an integer overflow—a number exceeding the range its storage can hold—while GitLab compiles a specially crafted regular expression. Under certain conditions, that parsing failure lets an unauthenticated attacker run code on the server. GitLab published detection rules for exploitation attempts, but installing a fix cannot establish whether an instance was already compromised.

For organizations running self-managed GitLab, especially on older branches, the flaw’s reach means current-branch inventories can miss exposure: each branch has its own corrected release. If a server was internet-facing, an upgrade closes the flaw but leaves open whether an attacker got in and affected the code and collaboration environment it hosts.

Timeline

• Oct 22 Reported by The Register Security
• Oct 21 Reported by The Hacker News

Sources

8 sources covering this story

• The Register Security Oct 22

  Max-severity GitLab bug allows remote code execution over 12 years of releases

  Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'

• CERT-SE Oct 22

  Kritisk sårbarhet i GitLab CE och EE - CERT-SE

  Gitlab har publicerat säkerhetsuppdateringar för en ny sårbarhet, CVE-2026-110264.

• BleepingComputer Oct 22

  GitLab warns of new max severity code execution vulnerability

  GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.

• CERT-EU Advisories Oct 22

  Critical Vulnerability in GitLab Community and Enterprise Editions

• NCSC-NL Advisories Oct 22

  Kwetsbaarheden verholpen in GitLab door GitLab Inc.

  GitLab heeft 12 kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE).

• INCIBE-CERT Oct 22

  Múltiples vulnerabilidades en GitLab CE/EE de GitLab

  GitLab ha publicado una actualización crítica que corrige vulnerabilidades en CE y EE.

• CSIRT Italia / ACN Oct 22

  Risolte vulnerabilità in GitLab CE/EE

  Rilasciati aggiornamenti di sicurezza che risolvono 12 vulnerabilità, di cui 1 con gravità “critica” e 2 con gravità “alta”, in GitLab Community Edition (CE) ed Enterprise Edition (EE).

• The Hacker News Oct 21

  Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

  GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.

Entities

• CVE-2026-110264

Part of the PlainSec briefing for 2026-10-22

Editions

• Briefing for 2026-10-22

Related stories

• PHP2Shell attempts surge as embedded-product fixes lag
• Arista VeloCloud zero-day puts orchestration host at risk
• Siemens signed launcher hides a trojanized installer