GitLab on Wednesday patched a vulnerability with the highest possible severity rating, a perfect 10, in the software that hosts source code for much of the technology industry. The flaw, tracked as CVE-2026-110264, is an integer overflow in regular expression compilation in GitLab Community Edition and Enterprise Edition. Under certain conditions, GitLab said, it could have allowed an unauthenticated user to execute arbitrary code on the GitLab server using a specially crafted regular expression.
The affected range is the alarming part: releases dating back to GitLab 7.0, released in June 2014, a full 12 years of versions. Fixes were released in versions 19.5.1, 19.4.3 and 19.3.6, and backported to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab strongly recommends that all organisations running vulnerable software upgrade as soon as possible. Its own hosted services, GitLab.com and GitLab Dedicated, are already patched, and it released two threat detections for self managed customers. The flaw was reported by bug hunter Johan Carlsson through GitLab’s HackerOne programme.
The exposure is what sits on the server. As threat detection firm SOC Prime put it in a warning quoted by The Register, GitLab repositories frequently contain source code, CI and CD configuration, deployment secrets, access tokens and infrastructure definitions, so server level compromise can lead to credential theft, repository manipulation, supply chain attacks and lateral movement into production environments. GitLab claims 50 million registered users and more than half of the Fortune 100.
There is no indication yet of exploitation in the wild. That reprieve is unlikely to last: last month attackers began battering another maximum severity GitLab flaw within days of its patch, according to CISA and private researchers. In a week defined by PHP2Shell exploitation at scale, self hosted GitLab instances are the next patching race.