GitLab Patches CVSS 10.0 Unauthenticated RCE Flaw Affecting 12 Years of Releases
jedisct1 · x · 2026-10-22
GitLab shipped fixes on October 21 for CVE-2026-110264, a maximum-severity (CVSS 10.0) flaw allowing unauthenticated remote code execution on self-managed servers via an integer overflow while compiling a crafted regex — affecting every release back to 7.0 in 2014.
- The October 12 update only covered 19.2+, so instances patched nine days earlier fell back into the affected range and must upgrade again.
- Seven release branches were fixed at once (19.5.1 through 18.11.13), four older than GitLab's normal patch policy.
- Only self-managed installs need to act; GitLab.com and Dedicated already have the fix. No evidence of exploitation so far, and the trigger conditions remain undisclosed.
- The poster notes the run of recent incidents (eMudhra, OpenCode, PingCAP, PHP, Node, LiteLLM) and asks what's next.
Related event: GitLab Patches Critical CVSS 10.0 Unauthenticated RCE Flaw(2 posts)→
More from Safety
- Palo Alto CEO: 'Trophy Hunters' Are Now Hunting the Next PHP-Style Vulnerability — johncoogan · 2026-10-22
- ML pioneer Dietterich: OpenAI's agents ran for months with essentially no supervision — tdietterich · 2026-10-22
- NCSC advisory details the two PHP flaws enabling unauthenticated remote code execution — LuizaJarovsky · 2026-10-22
- AI-discovered critical PHP vulnerabilities leaked, UK NCSC urges immediate patching — LuizaJarovsky · 2026-10-22
- eMudhra mess exposes all the software that ships without auto-updates — kuza55 · 2026-10-22
- Dev jokes that their SSL root cert's private key is just '5' — kuza55 · 2026-10-22