by Kastro
Paper/Archive/CVE-2026-110264

CVE-2026-110264

GitLab GitLab — Integer Overflow or Wraparound in GitLab

EPSS 1%CVSS 10.0
critical.is priorityof 100
44
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 70.5.705 × 2014.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Affected

ProductAffectedFixed inSource
GitLab7.0 – < 18.11.1318.11.13CNA
GitLab19.0 – < 19.0.1019.0.10CNA
GitLab19.1 – < 19.1.919.1.9CNA
GitLab19.2 – < 19.2.919.2.9CNA
GitLab19.3 – < 19.3.619.3.6CNA
GitLab19.4 – < 19.4.319.4.3CNA
GitLab19.5 – < 19.5.119.5.1CNA

Scores by source

GitLab (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/work_items/633633exploithackerone.com/reports/4093475refdocs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released