An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
PUBLISHED5.2ApplicationCWE-190
Integer Overflow or Wraparound in GitLab
Problem type
Affected products
GitLab
GitLab
< 18.11.13 - AFFECTED
< 19.0.10 - AFFECTED
< 19.1.9 - AFFECTED
< 19.2.9 - AFFECTED
< 19.3.6 - AFFECTED
< 19.4.3 - AFFECTED
< 19.5.1 - AFFECTED
References
gitlab.com
https://gitlab.com/gitlab-org/gitlab/-/work_items/633633
HackerOne Bug Bounty Report #4093475
https://hackerone.com/reports/4093475
docs.gitlab.com
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
GitHub Security Advisories
GHSA-83vq-rvff-66gw
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19...
https://github.com/advisories/GHSA-83vq-rvff-66gwAn issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-110264
hackerone.com
https://hackerone.com/reports/4093475
docs.gitlab.com
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released
gitlab.com
https://gitlab.com/gitlab-org/gitlab/-/work_items/633633
github.com
https://github.com/advisories/GHSA-83vq-rvff-66gw
From Hacker News
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-110264Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-110264",
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"dateUpdated": "2026-10-22T00:33:48.179Z",
"dateReserved": "2026-10-13T18:34:15.123Z",
"datePublished": "2026-10-22T00:33:48.179Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab",
"dateUpdated": "2026-10-22T00:33:48.179Z"
},
"title": "Integer Overflow or Wraparound in GitLab",
"descriptions": [
{
"lang": "en",
"value": "An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression."
}
],
"affected": [
{
"vendor": "GitLab",
"product": "GitLab",
"cpes": [
"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
],
"repo": "https://gitlab.com/gitlab-org/gitlab",
"defaultStatus": "unaffected",
"versions": [
{
"version": "7.0",
"status": "affected",
"versionType": "semver",
"lessThan": "18.11.13"
},
{
"version": "19.0",
"status": "affected",
"versionType": "semver",
"lessThan": "19.0.10"
},
{
"version": "19.1",
"status": "affected",
"versionType": "semver",
"lessThan": "19.1.9"
},
{
"version": "19.2",
"status": "affected",
"versionType": "semver",
"lessThan": "19.2.9"
},
{
"version": "19.3",
"status": "affected",
"versionType": "semver",
"lessThan": "19.3.6"
},
{
"version": "19.4",
"status": "affected",
"versionType": "semver",
"lessThan": "19.4.3"
},
{
"version": "19.5",
"status": "affected",
"versionType": "semver",
"lessThan": "19.5.1"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-190: Integer Overflow or Wraparound",
"cweId": "CWE-190",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"
},
{
"url": "https://hackerone.com/reports/4093475",
"name": "HackerOne Bug Bounty Report #4093475",
"tags": [
"technical-description",
"exploit",
"permissions-required"
]
},
{
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1, or later."
}
],
"credits": [
{
"lang": "en",
"value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program",
"type": "finder"
}
]
}
}
}
Funnily enough, regarding SoftTalker's point, just a few hours after my original comment, CVE-2026-110264 (a CVSS 10.0... worse than PHP's RCE) rolled in for GitLab, which would be prevented by using a memory safe language to write the interpreter instead of C.