GitLab has released patches for CVE-2026-110264, a maximum severity vulnerability that allows remote code execution on affected servers. The flaw stems from malformed regular expressions that can be exploited to execute arbitrary code.
Fixed versions are now available across Community Edition and Enterprise Edition: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab.com is already running the patched version, and GitLab Dedicated customers on version 19.3.5-internal0, 19.4.2-internal0, or later are protected.