Vulnerability Description
CVE-2026-110264 is an integer overflow in the regular-expression compiler of self-managed GitLab Community Edition and Enterprise Edition, scored CVSS v3.1 10.0 by GitLab as the CNA. GitLab’s critical patch release states that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression. Every release from 7.0 up to the October 21 fixes is affected.
GitLab’s own detection write-ups place the flaw in the renderer for Org-mode (.org) files, which passes a keyword from a #+TODO: line into a regular expression, and state that the attack needs no authentication, only one public project that can hold the .org payload. The same write-ups name only the three standard releases as fixes. GitLab’s advisory also lists backports to 18.11.13, 19.0.10, 19.1.9, and 19.2.9, and it is the authority on fixed versions.
This is the second critical regular-expression flaw GitLab has fixed in October. Its October 12 release for CVE-2026-97229 shipped 19.4.2, 19.3.5, and 19.2.8, each below this flaw’s fix for its branch.
Impact
GitLab’s detection guidance states that successful exploitation runs code on the server as the git user. That exposes the instance secrets in gitlab-secrets.json, every CI/CD variable, and runner and access tokens, and gives read and write access to every repository on the instance. Where an instance was reachable while unpatched, look for the signs of code execution GitLab lists, among them unexpected child processes of Puma, new files owned by git in /tmp, and changed crontabs or SSH keys for the git user. Where they appear, GitLab’s guidance is to treat the instance as compromised and rotate those secrets.
Details
| CVE ID | CVE-2026-110264, CVSS v3.1 10.0 (critical), assigned by GitLab. |
| Date of Disclosure | GitLab: October 21, 2026. NVD: October 22, 2026. |
| Affected Assets | Self-managed GitLab Community Edition and Enterprise Edition, all deployment types. GitLab.com and GitLab Dedicated are patched and require no action. |
| Vulnerable Software Versions | 7.0 through 18.11.12, 19.0.0 through 19.0.9, 19.1.0 through 19.1.8, 19.2.0 through 19.2.8, 19.3.0 through 19.3.5, 19.4.0 through 19.4.2, and 19.5.0. |
| PoC Available | No public proof-of-concept for this CVE as of October 22, 2026. Two GitHub repositories labeled with it appeared that day; one implemented the sibling CVE-2026-97229 by its author’s own account and was deleted, and the other was emptied. |
| Exploitation Status | The Censys Rapid Response team is not aware of exploitation in the wild as of October 22, 2026, and CISA’s SSVC assessment on the NVD record lists exploitation as none. |
| Patch Status | Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, released October 21, 2026. |
Censys ARC Perspective
On the day of disclosure, Censys observed roughly 82,000 hosts and about 209,000 web properties running GitLab. Because every release from 7.0 up to the October 21 fixes is affected, effectively that whole population was in range.
We estimate that more than half of internet-exposed GitLab servers run a release line more than seven months old, which gets no fix of its own, and that more than a quarter are three or more major versions behind the current one. Those servers can only be patched by upgrading to a newer release line, stepping through GitLab’s required upgrade stops. The rest run release lines GitLab fixed directly or by backport. These estimates are point-in-time as of October 21, 2026.
The Censys Rapid Response team notified customers of potentially vulnerable instances in their attack surfaces.
Censys Queries
Platform: Found: 81,820 hosts and 208,024 web properties
host.services.software: (vendor: "gitlab" and product: "gitlab") or web.software: (vendor: "gitlab" and product: "gitlab")