Max-severity GitLab bug allows remote code execution over 12 years of releases

GitLab on Wednesday patched a maximum-severity flaw that could allow unauthenticated attackers to execute arbitrary code on self-managed servers under certain conditions. Affected software releases date back a full 12 years - so upgrade to a fixed version now. The integer overflow bug, tracked as CVE-2026-110264 , affects regular-expression compilation in GitLab Community Edition (CE) and Enterprise Edition (EE), including versions dating back to GitLab 7.0, released in June 2014.