91ÑÇÉ«

Information Security Advisory

A recently disclosed vulnerability (CVE-2026-110264) affects GitLab Community Edition (CE) and Enterprise Edition (EE) may allow unauthenticated remote attackers to execute arbitrary code on vulnerable Gitlab servers.

Severity level:
CVSS Score: 10/Critical

Description:
CVE-2026-110264 is a critical integer overflow vulnerability in the regular-expression compiler used by GitLab. Under certain conditions, an unauthenticated attacker can submit a specially crafted regular expression that triggers the flaw and enables arbitrary code execution on the affected GitLab server.

Affected Versions:
The vulnerability affected GitLab CE and EE.

• All versions from 7.0 through 18.11.12
• 19.0 before 19.0.10
• 19.1 before 19.1.9
• 19.2 before 19.2.9
• 19.3 before 19.3.6
• 19.4 before 19.4.3
• 19.5 before 19.5.1

Impact:
Successful exploitation may allow attackers to execute arbitrary code on GitLab servers.

Resolution:
Upgrade immediately to one of the following fixed versions or later.

• Gitlab 18.11.13
• Gitlab 19.0.10
• Gitlab 19.1.9
• Gitlab 19.2.9
• Gitlab 19.3.6
• Gitlab 19.4.3
• Gitlab 19.5.1

Reference:

UIT Information Security




Contact

IT Client Services at askIT@yorku.ca or 416 736 5800

 | VISIT WWW.YORKU.CA
This email was sent by: 91ÑÇÉ«, 4700 Keele Street, Toronto, Ontario M3J 1P3

This email is viewed best in Microsoft Outlook for web