CVE-2026-110264 – GitLab CE/EE regex compiler integer overflow enables unauthenticated RCE – Upwind

Critical integer overflow in GitLab CE/EE Regular Expression Compiler lets an unauthenticated attacker compile a specially crafted regex to trigger arbitrary code execution on the GitLab server. Affects GitLab CE/EE 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1. Upgrade to GitLab CE/EE 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1, or later patched versions.