GitLab issues security updates for critical unauthenticated code execution vulnerability

GitLab has published updated versions of its Community Edition and Enterprise Edition software to address a dozen security issues, CSO Online reported on October 22, 2026. The most severe flaw, tracked as CVE-2026-110264, is a critical integer overflow vulnerability. CSO Online reported that the bug allows an unauthenticated user to execute arbitrary code on the underlying GitLab server under certain conditions. [1]

The vulnerability stems from an integer overflow that occurs when compiling a specially crafted regular expression, according to GitLab statements cited by CSO Online. The vendor urged system administrators to upgrade to patched releases as soon as possible. The security updates resolve a total of 12 flaws that previously allowed various unauthenticated actions across affected deployments. [1]

Version control systems organize and track historical changes in source code files, which makes securing platforms like GitLab essential for development environments. The GitLab project began in 2011 as an open-source initiative created by Ukrainian developer Dmitriy Zaporozhets before incorporating in the United States as GitLab Inc. under former chief executive officer Sytse Sijbrandij and current leader Bill Staples. [2][3]

This emergency patch release follows earlier security updates issued by the vendor, as FTMQ Security reported earlier. On October 12, 2026, GitLab resolved a separate maximum-severity integer overflow vulnerability tracked as CVE-2026-97229, which also permitted unauthenticated code execution within CI CD regular-expression handling routines. Security teams are advised to apply the latest software updates immediately to prevent potential server compromises. [1][5]