Administrators running their own GitLab servers are being urged to patch a critical flaw that could let an attacker execute code without logging in. GitLab released the fixes on October 21 and assigned CVE-2026-110264 the maximum CVSS 3.1 severity score of 10.0.
The company’s critical patch advisory says an integer overflow while compiling a specially crafted regular expression could allow arbitrary code execution under certain conditions. It affects Community Edition and Enterprise Edition, with the impacted range beginning at version 7.0. The advisory does not publish the full exploit conditions.
The fixed releases are 19.5.1, 19.4.3 and 19.3.6. GitLab also backported the correction to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The vendor recommends immediate upgrades for affected self-managed installations, using the appropriate fixed release and supported upgrade path.
GitLab.com is already running the patched version. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes, the company says. Those internal build names should not be confused with public self-managed releases bearing similar numbers.
This is a different advisory from October 12’s CVE-2026-97229 release. Public versions 19.4.2, 19.3.5 and 19.2.8 remain below the new fixed thresholds. Administrators who installed those earlier updates still need to check the October 21 requirements.
GitLab credits researcher joaxcar with reporting the flaw through its bug-bounty program. It says the issue-tracker details for security fixes are normally made public 90 days after the release containing the correction. That disclosure schedule is separate from the availability of patches now.
For defenders, GitLab has released two threat detections named Onigmo native worker crash and Org mode render error burst. The advisory does not publish a successful-compromise count. It should not be confused with evidence of confirmed server compromises in other products.
The upgrade itself needs planning. The release notes flag database migrations in 19.4.3 and 19.3.6, and post-deploy migrations in 19.4.3. GitLab warns that single-node upgrades involve downtime; properly performed multi-node zero-downtime procedures can avoid it. Its upgrade-path documentation also requires intermediate stops and completed background migrations where applicable.
The warning arrives alongside other patch activity, including PHP2Shell’s separate security-release planning. Those are different products and vulnerabilities. For GitLab operators, the relevant action is to verify their deployment type and installed build against the vendor’s current fixed-version list, rather than assume last week’s update is sufficient.
