CVE-2026-110264CWE-190

CVE-2026-110264

Critical · published October 22, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00505 · 42.3th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-10-22T05:16Z
References (3)
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ · [email protected]https://gitlab.com/gitlab-org/gitlab/-/work_items/633633 · [email protected]https://hackerone.com/reports/4093475 · [email protected]
EPSS history
Timeline
  • 23 OCT 03:55Z
    EPSS moved — → 1%
    epss
  • 22 OCT 00:33Z
    Integer Overflow or Wraparound in GitLab
    cvelistv5
  • 22 OCT 00:33Z
    Integer Overflow or Wraparound in GitLab
    cvelistv5