CVE-2026-110264: GitLab CE/EE RCE Vulnerability

CVE-2026-110264 Overview

CVE-2026-110264 is an integer overflow vulnerability [CWE-190] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Under certain conditions, an unauthenticated attacker can execute arbitrary code on the GitLab server by submitting a specially crafted regular expression that triggers an integer overflow during compilation. GitLab released patched versions on the 19.5.1 release line to address the issue.

Critical Impact

Unauthenticated remote code execution on GitLab servers via a crafted regular expression. The vulnerability carries a maximum CVSS score of 10.0 with a scope change, allowing attackers to compromise the hosting environment beyond the GitLab application boundary.

Affected Products

• GitLab CE/EE versions 7.0 through 18.11.12
• GitLab CE/EE 19.0.x through 19.4.x prior to the respective patched releases
• GitLab CE/EE 19.5.0

Discovery Timeline

• 2026-10-22 - CVE-2026-110264 published to the National Vulnerability Database (NVD)
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-110264

Vulnerability Analysis

The vulnerability stems from an integer overflow condition that occurs when GitLab compiles a regular expression supplied through an attacker-controlled input path. When the integer value representing a size, length, or offset wraps around its storage boundary, the regex compiler proceeds with an undersized or miscalculated allocation. This creates memory safety conditions that an attacker can convert into arbitrary code execution on the host process.

The scope change indicator in the vulnerability metrics confirms that successful exploitation impacts resources beyond the vulnerable component itself. On typical GitLab deployments, this means a compromise can extend to the underlying operating system, adjacent services, repository data, CI/CD runners, and secrets stored on the instance.

Because the vulnerable code path can be reached without authentication, any GitLab instance exposed to untrusted networks is at direct risk. Self-managed GitLab installations that face the internet are the highest priority for remediation.

Root Cause

The root cause is an integer overflow [CWE-190] in the regular expression compilation routine. Specifically crafted inputs cause arithmetic on size or length values to exceed the maximum representable integer, resulting in incorrect buffer management during regex construction.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker submits a malicious regular expression to a GitLab endpoint that forwards the pattern to the vulnerable compiler. Successful exploitation yields arbitrary code execution in the context of the GitLab server process.

No public proof-of-concept code has been released. See the HackerOne Report #4093475 and GitLab Work Item #633633 for additional technical context published by GitLab.

Detection Methods for CVE-2026-110264

Indicators of Compromise

• Unexpected child processes spawned by the GitLab Rails or Puma worker processes, including shells, interpreters, or network utilities
• gitlab-rails/production.log or gitlab-workhorse logs containing requests with abnormally long or malformed regex parameters
• Outbound connections from the GitLab server to unknown IP addresses immediately following requests to search, API, or Git endpoints
• Crashes or segmentation faults in the Ruby runtime correlated with inbound HTTP requests

Detection Strategies

• Inspect reverse proxy and web application firewall logs for query parameters containing oversized or deeply nested regex patterns
• Alert on process-tree anomalies where ruby, puma, or unicorn processes spawn /bin/sh, curl, wget, or python
• Correlate GitLab version banners from internal asset inventories against the fixed version list to identify unpatched instances

Monitoring Recommendations

• Enable verbose request logging on GitLab and forward logs to a centralized analytics platform for retroactive hunting
• Monitor filesystem writes to /var/opt/gitlab, /tmp, and user home directories for unexpected binaries or scripts
• Track egress traffic from GitLab hosts and baseline normal destinations to surface command-and-control activity

How to Mitigate CVE-2026-110264

Immediate Actions Required

• Upgrade self-managed GitLab installations to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1 depending on the installed branch
• Restrict network exposure of GitLab administrative and API endpoints to trusted sources until patching is complete
• Audit recent access logs for suspicious regex-bearing requests and investigate matching sessions

Patch Information

GitLab addressed the vulnerability in patch release 19.5.1 and backported fixes to the supported release branches. Review the GitLab Patch Release 19.5.1 advisory for upgrade procedures and release notes. GitLab.com SaaS tenants are patched by the vendor; self-managed operators must apply updates manually.

Workarounds

• No official workaround has been published; upgrading is the only supported remediation
• Place GitLab behind an authenticating reverse proxy or VPN to reduce the unauthenticated attack surface
• Deploy a web application firewall rule to reject requests containing unusually large regex payloads as an interim control

# Verify installed GitLab version against the fixed releases
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example upgrade on Omnibus-based Debian/Ubuntu installations
sudo apt-get update && sudo apt-get install gitlab-ee=19.5.1-ee.0
sudo gitlab-ctl reconfigure && sudo gitlab-ctl restart