GitLab has released security patches for 12 vulnerabilities, including one of the most critical vulnerabilities that could allow arbitrary code execution.

GitLab, a development and operations platform, has released emergency patches '19.5.1,' '19.4.3,' '19.3.6,' '19.2.9,' '19.1.9,' '19.0.10,' and '18.11.13' for GitLab Community Edition (CE) and Enterprise Edition (EE). Twelve vulnerabilities are fixed. One of them allows an unauthenticated user to potentially execute arbitrary code on a GitLab server, and it has been rated 10 out of 10 on

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html

The vulnerabilities to be fixed include one 'critical,' two 'high,' five 'medium,' and four 'low.'

The vulnerability classified as 'critical,' CVE-2026-110264 , was reported by joaxcar through the HackerOne Bug Bounty Program. It states that 'under certain conditions, an integer overflow may occur when compiling a specially crafted regular expression, potentially allowing an unauthenticated user to execute arbitrary code on a GitLab server.'

The affected versions are extensive, including 'GitLab CE/EE versions 7.0 and later, up to the time this patch is applied.' Since version 7.0 was released in 2014, this means that the system has been potentially affected for 12 years.

GitLab also released patches on October 12th local time to address 24 vulnerabilities, including the critical vulnerability CVE-2026-97229 . Instances that have already applied those patches are also included in this update.

According to GitLab, there is no evidence that CVE-2026-110264 has been exploited in any attacks. It has also been confirmed that it is not included in the 'List of Known Exploited Vulnerabilities' published by the Cybersecurity and Infrastructure Security Agency (CISA) .