GitLab patches critical CVSS 10.0 remote code execution flaw in 19.5.1 release
GitLab has released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, fixing a CVSS 10.0 vulnerability that could let an unauthenticated user execute arbitrary code on the server. The company strongly recommends that all self-managed installations upgrade immediately.
- GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on October 21, 2026.
- CVE-2026-110264, an integer overflow in the regex compiler, scores CVSS 10.0 and could allow unauthenticated code execution.
- The release fixes twelve vulnerabilities: one critical, two high, five medium and four low.
- GitLab.com is already patched; self-managed installations should upgrade immediately.
- GitLab published two threat detections for self-managed customers to spot exploitation attempts.
The critical flaw: integer overflow in the regex compiler
The most severe issue is CVE-2026-110264, an integer overflow in the regular expression compiler that affects GitLab Community Edition (CE) and Enterprise Edition (EE). According to GitLab, under certain conditions an unauthenticated user could have executed arbitrary code on the GitLab server by supplying a specially crafted regular expression.
The flaw carries a CVSS score of 10.0. It affects all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Beyond the standard patch releases, GitLab backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9.
GitLab credited the researcher joaxcar, who reported the bug through the company's HackerOne bug bounty program. For self-managed customers, GitLab security published two threat detections to help spot exploitation attempts: "Onigmo native worker crash" and "Org mode render error burst".
Other vulnerabilities in the release
The release lists twelve security fixes in total: one critical, two high, five medium and four low severity. The two high-severity issues are:
- CVE-2026-15723 (CVSS 8.2): when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user.
- CVE-2026-112212 (CVSS 7.5): an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server. GitLab says its own team member Peter Arts found this one.
Among the medium-severity fixes, CVE-2026-12664 concerned a GraphQL field that let a user with a read_api-scoped token retrieve a project's incoming email address and create work items. CVE-2026-16255 involved incomplete enforcement of the instance-wide SAML/LDAP membership lock in GitLab EE. CVE-2026-105777 could expose sensitive internal server credentials through internal response headers. CVE-2026-13319 allowed an authenticated user to read milestone metadata, including titles, descriptions and full project paths, from private projects without membership. CVE-2026-112378 could let an authenticated user access paid AI features without a valid subscription.
The source text also lists four low-severity issues, covering merge request title rendering, merge request approval policy enforcement, security findings and group Duo admin-lock enforcement for Amazon Q settings.
Who needs to act
GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes and do not need to take action. Self-managed installations are the ones that must upgrade, and this applies to all deployment types, since none is singled out as unaffected.
GitLab explains that it ships vulnerability fixes in patch releases, either on a schedule, on the second and fourth Wednesdays of each month, or as ad-hoc critical patches for high-severity vulnerabilities. Details of each security issue are made public on the issue tracker 90 days after the release that patched it.
What it means for administrators
Given the maximum CVSS score, no authentication requirement and the possibility of arbitrary code execution, administrators of self-managed instances have a clear priority: move to the latest patch release of their supported version. GitLab says it is "highly recommended" that customers keep to the latest patch release to maintain good security hygiene. Teams that cannot upgrade at once can at least use the two published detections to monitor for exploitation attempts in the meantime.
