GitLab warns of new max severity code execution vulnerability

GitLab has issued fixes for a critical flaw in its Regular Expression Compiler, the component that parses and validates regex patterns in configuration files. Tracked as CVE-2026-110264, the bug is an integer overflow that could let an attacker with no authentication run arbitrary code on an affected server simply by submitting a maliciously crafted regular expression. The issue, found by researcher 'joaxcar' via GitLab's HackerOne program, is resolved in GitLab Community Edition and Enterprise Edition releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and administrators are urged to upgrade their self-managed instances right away, as GitLab.com and GitLab Dedicated have already applied the fix. This marks the second maximum-severity remote-code-execution bug GitLab has disclosed in its Regular Expression Compiler in just ten days, following CVE-2026-97229, and comes shortly after a separate critical path-traversal flaw, CVE-2026-85706, was added to CISA's known-exploited-vulnerabilities list last month. With thousands of GitLab CE servers still reachable online and the platform used by millions of developers, including many large enterprises, prompt patching is strongly advised.