10

CVE-2026-110264: gitlab Integer Overflow or Wraparound

CVSS: 10.0v3.1CriticalReceived
Published 22-10-2026Last modified 22-10-2026
Open JSON

Vulnerability summary

CVE-2026-110264 is a critical (CVSS 10.0) Integer Overflow or Wraparound vulnerability in gitlab. 1 public exploit is recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 22-10-2026
    PublishedVulnerability first disclosed.

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (hackerone.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Gitlab1 product
  • gitlab≥ 7.0, < 18.11.13 | ≥ 19.0, < 19.0.10 | ≥ 19.1, < 19.1.9 | ≥ 19.2, < 19.2.9 | ≥ 19.3, < 19.3.6 | ≥ 19.4, < 19.4.3 | ≥ 19.5, < 19.5.1

1 vendor · 1 product

References

3 links