GitLab CE/EE (19.4.0 - 19.4.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gitlab-ce/ee-19.4.0---19.4.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 05 Oct 2026 18:41:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGitLab CE/EE: Unauthenticated remote code execution (CVE-2026-110264)https://feed.craftedsignal.io/briefs/2026-10-gitlab-rce/Mon, 05 Oct 2026 18:41:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-gitlab-rce/An integer overflow vulnerability in GitLab CE/EE allows unauthenticated attackers to execute arbitrary code via specially crafted regular expressions.A critical integer overflow vulnerability (CVE-2026-110264) exists in GitLab CE/EE, enabling unauthenticated remote code execution. The vulnerability is triggered when the application processes a specially crafted regular expression. This issue affects multiple GitLab release branches: versions 7.0 through 18.11.12, 19.0.0 through 19.0.9, 19.1.0 through 19.1.8, 19.2.0 through 19.2.8, 19.3.0 through 19.3.5, 19.4.0 through 19.4.2, and 19.5.0.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the underlying GitLab server, typically resulting in full system compromise.

Recommendation

  • Upgrade GitLab CE/EE instances immediately to the patched versions: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1.
  • Audit web server access logs for anomalous, high-complexity, or exceptionally long regex patterns being submitted to application endpoints.
  • Restrict access to administrative or high-risk GitLab endpoints to trusted internal networks until patching is completed.
]]>criticaladvisorycvercevulnerabilitygitlab