Incident brief

GitLab issues an emergency code execution fix

A critical regular expression compiler flaw can allow unauthenticated code execution. GitLab recommends upgrading affected installations immediately.

No exploitation reportedFix availableCVE-2026-110264

Disclosed Oct 21, 2026Updated Oct 23, 2026Sources checked Oct 23, 2026 UTC

Vendor: GitLab
Exposure: Application or configuration dependent
Vendor severity: 10.0 · CVSS 3.1

What happened

GitLab rates the flaw CVSS 3.1 10.0. Exploitation depends on specified conditions; the rating does not establish attacks against your installation. The cited advisory does not report active exploitation.

GitLab.com is patched. Dedicated tenants on the internal builds identified in the advisory already have the fix. Operators of their own installations must verify their release against the vendor’s affected ranges.

Affected systems and fixes

Product	Affected	Fixed release / action
GitLab CE / EE 7.0–18.11	7.0 through versions before 18.11.13	18.11.13
GitLab CE / EE 19.0	19.0 before 19.0.10	19.0.10
GitLab CE / EE 19.1	19.1 before 19.1.9	19.1.9
GitLab CE / EE 19.2	19.2 before 19.2.9	19.2.9
GitLab CE / EE 19.3	19.3 before 19.3.6	19.3.6
GitLab CE / EE 19.4	19.4 before 19.4.3	19.4.3
GitLab CE / EE 19.5	19.5 before 19.5.1	19.5.1

Confirm the running version against the vendor advisory, including any distribution backports.

CISA exploitation evidence

Catalog 2026.10.23 · Checked Oct 24, 2026 UTC

No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.

GitLab

Response checklist

0 of 3 complete

Locate affected GitLab instancesCompare deployed CE and EE versions with the advisory. Check the release that is running, not only the package or image configured for deployment.Apply the emergency updateUpgrade to the fixed release for your supported branch and verify that each instance is serving the updated version.Record the exposure reviewReview available activity for the period before the update using the vendor guidance. Record findings and telemetry gaps separately from patch completion.

Sources

Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.

GitLab critical patch releaseGitLab · vendor · Checked Oct 23, 2026 UTC

Editorial record2 entries

Oct 23, 2026 UTCPriority override: Act now follows the vendor’s immediate upgrade recommendation for unauthenticated RCE, not a claim of observed exploitation.

Oct 23, 2026 UTCSet This week under Radar’s priority rules: critical vendor fix without reported exploitation. Exposed instances still need prompt patch planning.

Oktsec Assessment

Choose what to review

Patch verification Exposure check

Radar email

Get incident alerts and briefings

Act now incidents and team briefings, with sources and recommended actions.

Checking availability…