GitLab warns of new max severity code execution vulnerability

GitLab has disclosed and patched a maximum-severity vulnerability, CVE-2026-110264, in its Regular Expression Compiler that could allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers via a specially crafted regular expression. The flaw stems from an integer overflow weakness and affects multiple versions of GitLab Community Edition (CE) and Enterprise Edition (EE). Users are urged to upgrade immediately, as the vulnerability could lead to full system compromise. This follows recent critical GitLab vulnerabilities, including CVE-2026-97229 and CVE-2026-85706, the latter of which was added to CISA's known exploited vulnerabilities list.

AI-extracted · verify before operational use