GitLab has patched CVE-2026-110264, a serious bug spanning nearly every supported release line going back to version 7.0. An unauthenticated attacker could trigger an integer overflow by submitting a specially crafted regular expression, ultimately letting them run arbitrary code on the GitLab server itself. Given GitLab's role hosting source code and CI pipelines for countless organizations, admins running affected versions should prioritize updating to the patched releases (18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1 and later).
// source: nvd.nist.gov ↗