The software development platform GitLab has released urgent security updates to address a high-severity security vulnerability in the Regular Expression Compiler, which allows unauthenticated attackers to execute arbitrary code remotely on vulnerable servers.
The vulnerability is identified as CVE-2026-110264 and was discovered by a security researcher known by the alias joaxcar through the bug bounty program on the HackerOne platform. The security issue arises due to an integer overflow error within the backend regular expression engine that handles the parsing and validation of regular expressions in configuration files.
Affected versions and required solutions
The company has fixed the flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The company warned all users and administrators of the need for immediate updates to avoid risks.
The company explained that the GitLab.com platform already has the updated version, while GitLab Dedicated subscribers received the updates in versions subsequent to 19.3.5-internal0 and 19.4.2-internal0 without the need for additional action.
Why this news matters
This vulnerability highlights the increasing risks associated with regular expression parsing components in popular development platforms, as reports from the Shadowserver threat monitoring network indicate the existence of more than 2,700 community GitLab servers exposed online. This vulnerability gains additional severity as it comes shortly after the detection of other critical vulnerabilities in the same platform, including the vulnerability registered as CVE-2026-97229, which is also linked to the regular expression engine in Continuous Integration and Continuous Delivery (CI/CD) systems, and the previous vulnerability CVE-2026-85706, which was exploited by the US Cybersecurity and Infrastructure Security Agency (CISA) in actual attacks.