Unauthenticated Remote Code Execution in GitLab: CVE-2026-110264

Summarize this threat intelligence article with AI:

Ask ChatGPTAsk GrokAsk PerplexityAsk ClaudeAsk Google AI

Summary

About the Vulnerability

Component Introduction

GitLab is an all-in-one DevSecOps platform developed by GitLab Inc. Its core application is built primarily with Ruby on Rails and can be deployed as a cloud-hosted service (gitlab.com) or a self-managed instance (CE/EE). It supports the entire software development lifecycle, including code repository hosting, issue tracking, merge request reviews, built-in CI/CD pipelines, container and package registries, and security scanning.

Vulnerability Description

On October 23, 2026, Sangfor FarSight Labs received notification of the code execution vulnerability in GitLab (CVE-2026-110264), classified as critical in threat level.

An integer overflow occurs when GitLab compiles a regular expression containing a special construct, which can lead to remote code execution. The vulnerability exists in GitLab's Org-mode document rendering process. When a specially crafted Org-mode file is rendered, the file keyword content is concatenated into a regular expression without escaping. During regular expression compilation, the repetition count of a quantifier wraps around a 16-bit integer, resulting in out-of-bounds memory access. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability to execute arbitrary code on the GitLab server.

Affected Versions

The following GitLab versions are affected:

• 7.0 <= GitLab CE/EE < 18.11.13
• 19.0 <= GitLab CE/EE < 19.0.10
• 19.1 <= GitLab CE/EE < 19.1.9
• 19.2 <= GitLab CE/EE < 19.2.9
• 19.3 <= GitLab CE/EE < 19.3.6
• 19.4 <= GitLab CE/EE < 19.4.3
• 19.5 <= GitLab CE/EE < 19.5.1

Solutions

Remediation Solutions

Official Solution

The following patched versions have been officially released. Affected users are advised to promptly upgrade to the corresponding patched version.

• GitLab CE/EE >= 18.11.13
• GitLab CE/EE >= 19.0.10
• GitLab CE/EE >= 19.1.9
• GitLab CE/EE >= 19.2.9
• GitLab CE/EE >= 19.3.6
• GitLab CE/EE >= 19.4.3
• GitLab CE/EE >= 19.5.1

Download link: [https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)

Workarounds

1. Disable unused functional modules to reduce attack entry points.
2. Follow the principle of least privilege to strictly control the scope of permissions for sensitive operations.
3. Do not expose services to the Internet unless necessary, to limit the access sources to trusted ranges.
4. Regularly update the system and components to secure versions so that known vulnerabilities can be patched at the earliest opportunity.

Sangfor Solutions

Risk Asset Discovery

The following Sangfor service can proactively detect CVE-2026-110264 vulnerabilities and quickly identify affected assets in batches in business scenarios:

• Athena Endpoint Protection Platform (EPP): The corresponding asset discovery solution has been released. The fingerprint ID is 0006687.

Timeline

On October 23, 2026, Sangfor FarSight Labs received notification of the unauthenticated remote code execution vulnerability in GitLab (CVE-2026-110264).

On October 23, 2026, Sangfor FarSight Labs released a vulnerability alert.

Reference

[https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)

Sangfor Farsight Labs is dedicated to tracking and analyzing global advanced threat landscapes. By leveraging its robust automated attribution and external monitoring systems, the lab delivers rapid, precise analysis and cross-correlation of APT attack samples. Having archived comprehensive profiles on dozens of APT and cybercrime entities, Farsight Labs has a proven track record of helping clients successfully mitigate high-stakes APT and cybercriminal incidents through expert incident response. In an era of escalating security conflicts and evolving TTPs, Sangfor’s Advanced Threat Team is committed to continuous vigilance and the rigorous research of new global security threats to ensure proactive defense.