EXPLORINEER
en

UK — The Register

Max-severity GitLab bug allows remote code execution over 12 years of releases

Security2 min read

GitLab, a tool that developers use to store and manage code, has patched a very serious bug. The bug could let an attacker run their own code on a GitLab server without logging in.

What happened

On Wednesday, GitLab fixed a flaw rated the highest possible severity. Under certain conditions, an attacker who is not logged in could run arbitrary code on a self-managed GitLab server. The bug is tracked as CVE-2026-110264. It affects the code that handles regular expressions, which are patterns used to search text. The vendor says the problem is an integer overflow, which happens when a number gets too big for the space set aside for it. A bug hunter named Johan Carlsson reported it. GitLab says it is strongly recommending that all users upgrade as soon as possible.

Key facts

  • Severity score: 10 out of 10 (CVSS, the standard scale for how serious a bug is).
  • Affected versions date back to GitLab 7.0, released in June 2014, so about 12 years.
  • Fixed versions: 19.5.1, 19.4.3, and 19.3.6. Fixes were also backported to 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
  • GitLab says it has more than 50 million registered users.

Why GitLab is a big target

GitLab is used by many large companies. It stores source code, build settings, passwords and keys, and links to live systems. If an attacker takes over a server, they may be able to steal secrets, change code, or move deeper into a company's network. GitLab.com and GitLab Dedicated are already patched by GitLab itself. Only companies that run their own GitLab servers need to act.

Why it matters

This bug is easy to reach without a login and could do a lot of damage. Security experts expect criminals to start scanning for unpatched servers soon. Last month, attackers also quickly began using another top-severity GitLab flaw after it was patched. Companies that run self-managed GitLab should upgrade now and check for signs of attack.

What to watch

  • Whether attackers start using this bug in real attacks.
  • Whether companies upgrade to a fixed version in time.
  • Any new threat detection rules that GitLab or security firms publish.

Glossary

GitLab
A company and software tool that lets developers store, share, and build their code.
CVE-2026-110264
The official ID number given to this specific security bug so people can track it.

Same story, different eyes

More in this topic

Security전자신문

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

SecurityVnExpress

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.

Security전자신문

Election Deepfakes Up 27% Worldwide; South Korea Ranks Third in Cumulative Cases

Reported AI-generated election deepfakes surged worldwide, with January to September 2026 cases already exceeding last year's full-year total by 27%, according to a Surfshark study. South Korea ranks third globally in cumulative cases with 16 since 2021, behind the United States and India. The study counted 235 cases across 46 countries from January 2020 to September 2026.