GitLab patches a maximum-severity integer overflow flaw
What happened
GitLab released patch versions 19.5.1, 19.4.3 and 19.3.6 fixing an integer overflow in its regular expression compiler, CVE-2026-110264. The flaw has a CVSS score of 10.0 and lets unauthenticated users run arbitrary code on GitLab servers. Versions from 7.0 up to before 19.5 are affected. GitLab advises all self-managed instances to upgrade immediately; GitLab.com and GitLab Dedicated were already patched at the time of the report.
Written by AI from the coverage · updated 2 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageGitLab CVSS 10.0 Integer Overflow issue
GitLab 发布 19.5.1、19.4.3、19.3.6 等补丁版本，修复 CVSS 10.0 的正则表达式编译器整数溢出漏洞（CVE-2026-110264），该漏洞可让未认证用户在 GitLab 服务器上执行任意代码。受影响版本覆盖 7.0 至 19.5 之前，官方建议所有自管理实例立即升级，GitLab.com 与 GitLab Dedicated 已完成修补。
Heat over time
Not enough continuous observations to draw a trend yet.