CVE-2026-110264: GitLab (Critical, CVSS 10)
- CVSS
- 10 Critical (v3.1)
- EPSS
- 0.5% chance of exploitation in the next 30 days (higher than 42.2% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 3 GitHub repositories
- Weakness
- CWE-190
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Published
- Oct 22, 2026
What it is
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Description from the National Vulnerability Database.
What to do
Check whether you run GitLab, then apply the vendor’s fix or mitigation from the advisories below. Because this flaw is exploited or has public exploit code, treat it as urgent and check for signs of compromise, not just the patch level.
ThreatRoundup coverage
GitLab’s CVSS 10 Regex Bug Reaches Back 12 Years to Version 7.0
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.