GitLab CVE-2026-110264: LDAP injection and request smuggling too

On 22 October ARX News covered CVE-2026-110264 in GitLab Community Edition (CE) and Enterprise Edition (EE), the integer overflow in the regular expression compiler with a CVSS score of 10, based on the advisories from CERT-EU and NCSC-NL. In the following hours, Korea’s KISA/KrCERT, the Cyber Security Agency of Singapore (SingCERT) and Spain’s INCIBE-CERT published their own advisories; The Hacker News and heise Security also reported on it. Below are the new points that matter to anyone running self-managed GitLab instances.

What the new advisories confirm

All sources agree on the affected and fixed versions: GitLab CE and EE from 7.0 onwards, with the first unaffected versions being 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. This is the reason for The Hacker News headline, which speaks of twelve years of affected releases.

According to SingCERT, the score is 10 out of 10 in CVSS v3.1: an unauthenticated attacker exploiting the vulnerability can execute arbitrary code and compromise the system. The advisory asks users to update immediately.

INCIBE-CERT adds two clarifications:

• the overflow occurs while compiling a specially crafted regular expression and allows code execution without authentication “under certain conditions”, which the advisory does not describe;
• in its table the vulnerability is listed as not exploited. None of the other sources reports ongoing attacks.

The sources do not say whether CVE-2026-110264 is related to CVE-2026-97229, fixed in early October, which was also an integer overflow in the regular expression compiler.

The other vulnerabilities in the release

Besides the critical one, CERT-EU counted 2 high-severity, 5 medium and 4 low vulnerabilities, without identifiers. The KISA advisory names two of them:

• CVE-2026-15723, an LDAP injection in GitLab CE/EE: affected versions are those from 10.1 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1;
• CVE-2026-112212, an HTTP request/response smuggling flaw: affected versions are those from 18.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.

KISA does not give the severity of these two vulnerabilities or the conditions for exploiting them. INCIBE-CERT, for its part, writes that the release also fixes high-severity authentication vulnerabilities and cache poisoning in the OAuth/OIDC discovery endpoints, without giving identifiers. The sources do not allow us to say whether these are the same vulnerabilities listed by KISA.

One practical point: for these two CVEs, KISA’s table gives fixed versions only for the 19.3, 19.4 and 19.5 branches. For the 18.11, 19.0, 19.1 and 19.2 branches, which have their own fixed version for CVE-2026-110264, KISA does not list a fix. The other sources do not go into this detail: check GitLab’s bulletin for patch release 19.5.1.

In the same advisory, KISA also includes two vulnerabilities from patch release 19.4.1, an integer overflow (CVE-2026-93577) and a double free (CVE-2026-89078), fixed in versions 19.2.7, 19.3.3 and 19.4.1. If you have already installed the versions recommended in our October articles, these are already fixed.

GitLab.com and GitLab Dedicated

According to INCIBE-CERT, which reports the vendor’s guidance, GitLab.com is already running a fixed version. GitLab Dedicated instances on 19.3.5-internal0, 19.4.2-internal0 or later already include the fix. The work is therefore mainly on self-managed installations.

Impact for European and Italian organisations

For CVE-2026-110264 the priorities already given still apply: a GitLab server holds source code, pipelines and credentials, and the affected range covers practically every installation not yet updated to the 21 October releases.

The two CVEs identified by KISA concern features that are common in corporate installations: integration with LDAP directories and the HTTP traffic passing through the proxies and load balancers in front of GitLab. The sources do not say which configurations are exposed, so it is best not to assume you are out of scope.

For organisations within the scope of NIS2, what we wrote before still applies: vulnerability management, software supply chain security and, in the event of a significant incident, notification to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do now

1. Update every self-managed instance at least to the first unaffected version of its branch (18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 or 19.5.1), starting with those exposed to the Internet.
2. Prefer the 19.3, 19.4 or 19.5 branches: they are the only ones for which KISA also lists fixes for CVE-2026-15723 and CVE-2026-112212. If you stay on an earlier branch, check the 19.5.1 bulletin to see whether both fixes are included.
3. GitLab Dedicated: check that the instance is at least on 19.3.5-internal0 or 19.4.2-internal0.
4. Detection: apply GitLab’s published detection rules, already described in our 22 October article, to your logs. No source reports indicators of compromise.
5. If you find suspicious activity: treat the server as exposed, rotate the secrets used by pipelines and integrations, including LDAP service credentials, and assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a GitLab instance can be reached from outside. ARX Shield lists open vulnerabilities on monitored machines. ARX Sentry collects logs and events from servers where the agent is installed and checks file integrity in the chosen folders. With ARX Horizon you can look up vulnerability details from the portal.

Last updated: 22 October 2026