GitLab said on October 21, 2026 that it patched CVE-2026-110264, rated 10.0 out of 10 for severity. By GitLab's account, someone without an account could run their own code on a self-managed server using a specially built regular expression, a text matching pattern. Fixes arrive in seven version lines, 18.11.13 through 19.5.1, for Community and Enterprise editions. Affected versions reach back to 7.0. A researcher using the name joaxcar reported it through GitLab's bug bounty program.
As general background, an integer overflow happens when a number outgrows its storage and wraps around. Software that trusts that number can mishandle memory, which attackers sometimes turn into code execution. GitLab did not say what conditions an attack needs. Neither source reports attacks. GitLab's change list names a Ruby regexp repeat ID overflow patch, but does not link it to this flaw. BleepingComputer said Shadowserver tracks over 2,700 exposed Community Edition servers.
BleepingComputer noted that GitLab warned of another 10/10 flaw in a regular expression compiler ten days earlier, from the same researcher. Two in one component hints at where to look. Teams running their own GitLab should ask who owns upgrades, how fast a 10/10 can ship, and whether servers face the internet.