On October 21, GitLab released emergency security updates for a maximum-severity flaw that could let attackers without accounts run code on self-managed servers.
It urged affected administrators to upgrade. The flaw is tracked as CVE-2026-110264 and has a CVSS score of 10.0. The bug comes from an integer overflow, when a number becomes too large as GitLab turns a specially designed text-matching pattern into a form its software can use.
The flaw affects GitLab Community Edition and Enterprise Edition versions going back to version 7.0, released in 2014. This history does not mean the flaw was exploited for that entire period. GitLab says the bug could let attackers run any code “under certain conditions.”
The company has not publicly explained what those conditions are. As of October 22, the company had reported no known attacks exploiting the flaw. The fixes are versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13.
Administrators who installed GitLab’s October 12 update should still check which version they have. That earlier update did not include this fix. GitLab.com has already been patched.
Self-managed installations should upgrade to the fixed release for their version line.