GitLab 19.5.1: new unauthenticated RCE, CVE-2026-110264

On 21 October 2026 GitLab published patch release 19.5.1 of GitLab Community Edition (CE) and Enterprise Edition (EE). According to CERT-EU advisory 2026-019, published on 22 October, the updates fix a critical vulnerability, CVE-2026-110264 with a CVSS score of 10, which could allow an unauthenticated user to execute arbitrary code on the GitLab server, along with 11 other vulnerabilities. On the same day the Dutch NCSC-NL published advisory NCSC-2026-0447 on the vulnerabilities fixed in GitLab.

In October ARX News covered CVE-2026-97229, also scored CVSS 10, fixed in versions 19.4.2, 19.3.5 and 19.2.8. Those versions fall within the ranges affected by the new vulnerability: if you installed them, you need to update again.

What happened

According to CERT-EU, CVE-2026-110264 is an integer overflow in GitLab’s regular expression compiler, which could allow an unauthenticated user to execute arbitrary code on the affected server. The advisory does not describe the attack vector in detail or the exploitation conditions, and does not say whether the vulnerability is already exploited in real attacks.

CVE-2026-97229, fixed on 12 October, was also, according to CERT-EU, an integer overflow in the regular expression compiler, in that case the CI/CD one. The 22 October advisory does not say whether the two vulnerabilities are related.

CERT-EU recommends updating affected assets as soon as possible, starting with those exposed to the Internet, and running a compromise assessment to identify any systems already breached.

The text of the NCSC-NL advisory was not available at the time of writing. In its title, NCSC-NL rates it “M/H”: on its scale, medium likelihood and high damage.

Technical details

• CVE-2026-110264: CVSS 10, integer overflow in the regular expression compiler; arbitrary code execution without authentication.
• Other fixes: according to CERT-EU, GitLab also fixed 2 high, 5 medium and 4 low severity vulnerabilities. The advisory gives neither identifiers nor descriptions and refers to GitLab’s bulletin for patch release 19.5.1.
• MITRE ATT&CK: exploiting an exposed service without authentication corresponds to T1190 (Exploit Public-Facing Application).

Affected versions of GitLab CE and EE for CVE-2026-110264, according to CERT-EU:

• from 7.0 before 18.11.13;
• 19.0 before 19.0.10;
• 19.1 before 19.1.9;
• 19.2 before 19.2.9;
• 19.3 before 19.3.6;
• 19.4 before 19.4.3;
• 19.5 before 19.5.1.

First unaffected version of each branch: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. There is now a threshold for the 19.1 branch as well, for which the 12 October advisories gave none.

Detection

According to CERT-EU, GitLab has published two detection rules to identify exploitation attempts, in its public repository gitlab-security-oss/tldr:

• onigmo_native_worker_crash;
• org_mode_render_error_burst.

The advisory does not describe their content: consult them in GitLab’s repository and apply them to your instances’ logs. None of the sources reports indicators of compromise.

Impact for European and Italian organisations

As noted in the earlier articles, a GitLab server usually holds source code, pipeline configurations and credentials for integrations. The range given by CERT-EU starts at version 7.0: it therefore covers every CE and EE installation that is not yet running one of the 21 October versions.

This is the third GitLab vulnerability with a CVSS score of 10 covered by ARX News in just over a month, after CVE-2026-85706 in September and CVE-2026-97229 in October. Teams running GitLab instances should plan for closely spaced updates, outside the normal patch cycle.

For entities in scope of NIS2, vulnerability management and software supply chain security are part of the required measures. In the event of a significant incident, in Italy the notification goes to CSIRT Italia at ACN.

What to do now

1. Inventory: identify all GitLab CE and EE instances and their versions, and check which ones are reachable from the Internet.
2. Update: bring each instance at least to the first unaffected version of its branch (18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 or 19.5.1), starting with those exposed to the Internet, as CERT-EU recommends. This also applies to instances updated in October to 19.4.2, 19.3.5 or 19.2.8.
3. Compromise assessment: apply GitLab’s two detection rules to your logs, starting with the exposed instances.
4. Read GitLab’s bulletin for patch release 19.5.1 for details on the other 11 vulnerabilities.
5. If you find suspicious activity: treat the server as exposed, rotate the secrets used by the pipelines and assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your company exposes to the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a GitLab instance can be reached from outside. ARX Shield lists the open vulnerabilities on monitored machines. ARX Sentry collects logs and events from the servers where the agent is installed and checks file integrity in the chosen folders. With ARX Horizon you can look up vulnerability details from the portal.

Last updated: 22 October 2026