CVE-2026-110264Vulnerability

Reported by 6 independent sources · first reported 21 Oct 2026 by The Hacker News · last reported 23 Oct 2026

Last reported yesterday

What the reports say

7 reports, newest first · the exact sentence from each

“An earlier release from the same week, 4.0.8, does not include the fix for one of the flaws, CVE-2026-110264, so 4.0 users should install 4.0.9.”

The Hacker NewsNews23 Oct 2026
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
“[GitLab // CVE-2026-110264]”

Risky Business NewsNews23 Oct 2026
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies
“The integer overflow bug, tracked as CVE-2026-110264, affects regular-expression compilation in GitLab Community Edition (CE) and Enterprise Edition (EE), including versions dating back to GitLab 7.0, released in June 2014.”

The Register (security)News22 Oct 2026
Max-severity GitLab bug allows remote code execution over 12 years of releases
“De kwetsbaarheid met kenmerk CVE-2026-110264 heeft een CVSS-score van 10,0 en betreft een integer overflow bij het compileren van een speciaal vervaardigde reguliere expressie.”

NCSC-NL advisoriesGovernment22 Oct 2026
NCSC-2026-0447 [1.00] [M/H] Kwetsbaarheden verholpen in GitLab door GitLab Inc.
“Los rangos afectados varían según el CVE; el fallo crítico CVE-2026-110264 afecta a versiones desde la 7.0 anteriores a las versiones corregidas.”

INCIBE-CERTGovernment22 Oct 2026
Múltiples vulnerabilidades en GitLab CE/EE de GitLab
“Référence CVE CVE-2026-110264”

CERT-FRGovernment22 Oct 2026
Multiples vulnérabilités dans GitLab (22 octobre 2026)
“The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum.”

The Hacker NewsNews21 Oct 2026
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

Indicators reported together

named in the same reports

railway[.]comin 1 report
pylos[.]coin 1 report
infosec[.]exchangein 1 report
regexp[.]newin 1 report
hxxps://docs.gitlab[.]com/releases/patches/patch-release-gitlab-19-5-1-released/in 1 report

Copy these 5 indicators · defanged

5 indicators, defanged, one per line

railway[.]com
pylos[.]co
infosec[.]exchange
regexp[.]new
hxxps://docs.gitlab[.]com/releases/patches/patch-release-gitlab-19-5-1-released/

Also named with it: CVE-2026-15723, CVE-2026-112212, CVE-2026-97229, CVE-2026-89078, CVE-2026-93577, CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14288, CVE-2026-16255, CVE-2026-114625

Thanks — we review every report.

Report a wrong value