PolicyCortex
Request Access
Summary
  • CVE-2026-110264 scores 10.0 Critical. An unauthenticated user could run arbitrary code on the GitLab server.
  • The flaw is an integer overflow in the GitLab Regular Expression Compiler.
  • Affected versions run from 7.0 up to each fixed release in the record.
  • A code host holds source code and pipeline secrets. Its patch record is governance evidence.

No login was needed

GitLab hosts source code for many teams. A flaw there puts code and pipeline secrets at risk.

The Common Vulnerabilities and Exposures record for CVE-2026-110264 describes a remote code execution (RCE) flaw. The Common Vulnerability Scoring System (CVSS) score is 10.0, Critical. That is the highest score on the scale.

Under certain conditions, an unauthenticated user could run arbitrary code. The code would run on the GitLab server itself.

Where the flaw lives

The flaw is an integer overflow. It happens when GitLab compiles a specially crafted regular expression.

GitLab calls that component the Regular Expression Compiler. A regular expression is a pattern used to match text. The crafted pattern pushed a value past its limit.

The record credits the researcher joaxcar for the report. GitLab received it through the HackerOne bug bounty program.

Which systems are affected

The flaw affects GitLab Community Edition (CE). It also affects GitLab Enterprise Edition (EE).

Affected versions start at 7.0, before 18.11.13. The 19.0 line is affected before 19.0.10. The 19.1 line is affected before 19.1.9. The 19.2 line is affected before 19.2.9. The 19.3 line is affected before 19.3.6. The 19.4 line is affected before 19.4.3. The 19.5 line is affected before 19.5.1.

GitLab released the fixed versions on October 21, 2026. The fixed versions are 19.5.1 and 19.4.3. The list continues with 19.3.6 and 19.2.9. It ends with 19.1.9, 19.0.10, and 18.11.13.

GitLab says GitLab.com already runs the patched version. Self managed installs still need the upgrade.

The governance lesson

A code host is not a side system. It holds source code, build settings, and tokens. Those tokens often reach cloud accounts and production systems.

So the patch record for a code host matters. Record the version before the patch. Record the fixed version after the patch. Record the date and the person who verified it.

Continuous monitoring should name the code host by name. A scan list that skips development tools has a gap. This flaw is exactly the kind that gap hides.

PolicyCortex does not patch GitLab or clean hosts. PolicyCortex collects patch and configuration evidence from live systems. That evidence is what an auditor or assessor asks for.

What to do this week

Find every self managed GitLab install you run. Check its version against the affected ranges above. Upgrade each install to its fixed version.

Then verify the new version in the running system. Save the version output with the patch date. Keep the record with your other flaw remediation evidence.

Sources

Next step

Want code host patch evidence collected on a schedule, not by spreadsheet? See how PolicyCortex reads it from the live tenant.

Questions on this record
What is CVE-2026-110264?
An integer overflow flaw in the GitLab Regular Expression Compiler. It is rated 10.0 Critical.
Which versions fix it?
GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 on October 21, 2026.
Does PolicyCortex patch GitLab?
No. PolicyCortex does not patch GitLab or clean hosts. It collects patch evidence from live systems.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. Arista VeloCloud Orchestrator Zero-Day: A Signed-In User Becomes SuperuserArista confirms active exploitation of the on-premises VeloCloud Orchestrator flaw. A signed-in user can reach superuser rights through SQL injection.5 min
  2. Four Exploited Flaws Hit the Firewall, the Mail Gateway, and the Backup ServerCISA added four exploited flaws on October 14, 2026. They hit a Palo Alto Networks firewall, a Cisco email gateway, and an Ahsay backup server.5 min
  3. PwnEscape: The Linux Kernel Flaw That Escapes the Virtual MachineCVE-2026-99999 scores 9.3 Critical and lets a guest VM read host memory, crash the host, and run code as root. The fix is a host kernel update. Guest patches do not help.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere