CVE-2026-110264: GitLab unauthenticated code execution warrants prompt patching

CoeLab Real-World Impact: 83/100 — High. Editorial score v1.0. Evidence checked 2026-10-25T15:10:09.896731+00:00. CVSS and EPSS are separate measures, not this editorial score.

Rating breakdown: exploitation: 18, reachability: 25, consequences: 25, operational relevance: 15.

Who is affected

GitLab has released fixes for CVE-2026-110264, an integer-overflow vulnerability in regular-expression compilation that can permit unauthenticated code execution on a GitLab server under conditions the public advisory does not fully enumerate. This is a prompt patching priority for affected self-managed Community Edition and Enterprise Edition installations, not a claim that every reachable server has been compromised.

The vendor identifies these affected ranges: 7.0 up to but excluding 18.11.13; 19.0 up to but excluding 19.0.10; 19.1 up to but excluding 19.1.9; 19.2 up to but excluding 19.2.9; 19.3 up to but excluding 19.3.6; 19.4 up to but excluding 19.4.3; and 19.5 up to but excluding 19.5.1. These are vendor-declared ranges, not versions tested by The Coe Lab.

GitLab says its hosted service is patched. Its release notice also identifies Dedicated builds 19.3.5-internal0 and 19.4.2-internal0 or later as already containing the fixes. Managed-service status should not be confused with the status of an independently operated installation. The advisory does not restrict this issue to a particular installation packaging method.

Real-world impact and exploitation evidence

Code execution on a development platform could threaten the confidentiality and integrity of material accessible to that server, as well as service availability. Those are consequences to evaluate against local permissions and architecture, not evidence that repositories, build systems or downstream deployments have actually been breached.

The CoeLab Real-World Impact rating supplied for this revision is 83/100, High. Its components are exploitation 18/30, reachability 25/25, consequences 25/25 and operational relevance 15/20. Exploitation receives 18 because the supplied October 25 EPSS estimate is 0.010010000, just above the methodology’s 0.01 boundary. That estimate is not a count of attacks or proof of exploitation.

Reachability reflects the published network-accessible, low-complexity, no-privilege vector. Consequences reflect the vendor’s maximum CVSS base score. Operational relevance reflects the infrastructure product category, not measured adoption or an inventory of any reader’s systems. This editorial score is neither CVSS nor EPSS and is sensitive to category assumptions and threshold boundaries.

The supplied evidence has no KEV entry. An exploit-tagged bug-bounty reference does not establish malicious use in the wild. GitLab provides two detection resources, described as Onigmo native worker crash and Org mode render error burst; publishing detections likewise does not establish a confirmed exploitation campaign. No independently verified attack date is established by the primary material reviewed here.

Attack prerequisites

The vendor publishes CVSS 3.1 base severity 10.0 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This describes network access, low attack complexity, no required privileges, no user interaction, changed scope and high confidentiality, integrity and availability impacts. It is a severity model, not a guarantee of reliable exploitation in every configuration.

An attacker must be able to reach a vulnerable processing path that compiles attacker-influenced regular expressions. The public description retains a qualification about conditions without specifying the complete trigger path. It would therefore be unjustified to invent a required endpoint, feature setting, project permission or payload. Requiring ordinary user login elsewhere should not be assumed to protect a path assessed as requiring no privileges.

Actions and fixes

The practical remedy is a vendor-supported upgrade containing the fix. The named fixed releases are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. Choose a supported destination and follow the applicable upgrade procedure; the presence of a backport does not make an old release line indefinitely supported. An installation older than those branches should not assume that an arbitrary intermediate upgrade is sufficient.

For triage, establish the actual running version, its edition and whether the installation is self-managed. Schedule the appropriate upgrade, preserve a recovery path, and verify the version after deployment. Review the vendor’s detection guidance and relevant retained logs when evaluating possible prior exposure. A lack of crash alerts does not prove there was no exploitation, and a crash alone is not proof of code execution.

No complete non-upgrade workaround is established by the reviewed advisory. Restricting unnecessary network access may reduce opportunities while patching is arranged, but that is a general exposure-reduction measure, not a vendor-confirmed substitute for this fix. Do not assume a web application firewall rule or disabling an unrelated feature eliminates the vulnerable compilation path.

Uncertainty and what could change

The remaining gaps concern precise triggering conditions, reliable compromise indicators and confirmed malicious exploitation. Public technical details may expand later; GitLab describes a general policy of publishing vulnerability issues 90 days after the fixing release. That policy is not evidence that a particular exploit is already public or that delaying remediation is safe.

A subsequent vendor update, verified exploitation report or KEV addition could strengthen urgency or change investigation advice. Conversely, environment-specific reachability restrictions could change local prioritization without changing the supplied editorial score. The current recommendation rests on the vendor-confirmed impact and available fixes, not a manufactured claim of active attacks.

Sources and evidence date

The Coe Lab checked the GitLab patch advisory and the official CVE List record on October 25, 2026. The advisory dates the fixing release to October 21. The CVE record was published October 22 at 00:33:48 UTC and updated October 22 at 23:05:04 UTC. The record update timestamp must not be presented as an advisory update date; an exact advisory revision timestamp was not verified.

The discovery date is not established here, and reservation of a CVE identifier is not the discovery date. No KEV addition date is available in the supplied evidence. The official CVE JSON is linked because the CVE website could not be retrieved during this review. The public Security index was checked and showed no existing coverage of this CVE. No exploit testing or assessment of any private deployment was performed.

Primary-source links

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110264.json

AI-assisted research and drafting, with a separate model editorial review. CoeLab ratings are editorial judgments, not a substitute for checking your own versions and vendor advisories. Methodology: https://thecoelab.com/blog/security/methodology