GitLab Patches Second CVSS 10.0 Unauthenticated RCE in Nine Days, This One Reaching 12 Years of Releases (CVE-2026-110264)

Scope: GitLab Community Edition and Enterprise Edition, self-managed instances, all versions from 7.0 (2014) through the newly patched releases

Severity: Red

GitLab released emergency fixes on October 21, 2026, for CVE-2026-110264, a maximum severity integer overflow in the regular expression compiler that allows a completely unauthenticated attacker to execute arbitrary code on a self-managed GitLab server. What sets this one apart is reach: because the vulnerable component has been part of GitLab’s codebase since version 7.0, released in 2014, the flaw affects essentially every self-managed GitLab instance ever deployed that has not already been patched, roughly twelve years of releases in one advisory. GitLab backported the fix to seven version branches simultaneously, 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1, a step the company reserves specifically for its most severe issues. This is also the second CVSS 10.0 unauthenticated RCE GitLab has patched in just nine days, following CVE-2026-97229 on October 12 in the CI/CD regex compiler, suggesting the underlying regex engine GitLab relies on has deeper structural issues worth watching closely in the weeks ahead. Internet scanning shows roughly 60,000 self-managed GitLab instances currently exposed online. GitLab.com and GitLab Dedicated tenants on current internal releases are already protected and require no action. Organisations running self-managed GitLab must upgrade to the patched version for their branch immediately, treating any instance that is internet-facing as the highest priority.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.