GitLab patches 12-year-old regex bug that allows remote code execution
Self-hosted instances running software as far back as 2014 are vulnerable to an integer overflow flaw. GitLab urged self-managed users to patch immediately.
A critical security vulnerability lurking in GitLab since 2014 has finally received a fix. Tracked as CVE-2026-110264, the flaw stems from an integer overflow in the platform's regular expression compiler—the backend mechanism tasked with parsing and validating regex patterns across configuration files.
Under specific conditions, an unauthenticated attacker could exploit the overflow using a specially crafted regular expression to achieve remote code execution on the server. Security researcher joaxcar discovered and reported the issue through the bug bounty program on HackerOne.
The bug impacts every version of the software starting from 7.0, which debuted over twelve years ago. GitLab released security patches across multiple release lines, including Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
Administrative timing makes this update particularly frustrating. Admins who updated systems following a security release on October 12 must patch again: that previous round addressed only branch 19.2 and newer, meaning recently patched servers remained wide open to this newly resolved underlying flaw.
The issue only requires action from administrators running self-managed deployments. Managed cloud infrastructure on GitLab.com and dedicated enterprise environments running versions 19.3.5-internal0 or 19.4.2-internal0 and later have already been secured. According to telemetry from internet monitoring group Shadowserver, more than 2,700 Community Edition instances are currently visible online, though it remains unclear how many of those are secured or honeypots.
As of October 22, GitLab stated there is no evidence of active in-the-wild exploitation, and the issue has not appeared on the U.S. Cybersecurity and Infrastructure Security Agency's known exploited vulnerabilities catalog. The patch arrives just ten days after another maximum-severity (CVSS 10/10) code execution bug in the CI/CD regex pipeline was resolved by the same researcher.
Source: habr
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.