{"id":"CVE-2026-110264","summary":"Integer Overflow or Wraparound in GitLab","details":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","aliases":["BIT-gitlab-2026-110264"],"modified":"2026-11-10T12:12:23.004989680Z","published":"2026-10-22T00:33:48.179Z","related":["ALSA-2026:96067","ALSA-2026:96068","ALSA-2026:96120","ALSA-2026:96233","ALSA-2026:96235"],"database_specific":{"cna_assigner":"GitLab","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110264.json"},"references":[{"type":"WEB","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"},{"type":"WEB","url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110264.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264"},{"type":"REPORT","url":"https://hackerone.com/reports/4093475"},{"type":"PACKAGE","url":"https://gitlab.com/gitlab-org/gitlab"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/gitlab-org/gitlab","events":[{"introduced":"93bef4f04a185e21f7596587eb5e1a30f9a857fe"},{"fixed":"566583ad14f11307ca902c2dea58ce049b63058e"},{"introduced":"f07e3c5b3c8128be5db112e5b2b618fe31ea1b35"},{"fixed":"120c54bd6dcb88a771b54cdcf981fe99f503fa59"},{"introduced":"67581074a0aab1f53cdafe7eead5f5d07f3afec8"},{"fixed":"fe72d77fb158efb6b0d4e167133cd21e640315f0"},{"introduced":"68485a1eb627c9a992f266263157327649822db3"},{"fixed":"affb8c7b228049c0042d0370c106093ce8afefa4"},{"introduced":"8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6"},{"fixed":"768c3d28a5b65440eb01ea2753136711c8ab01cc"},{"introduced":"fa703f93afaf1133cd263f6aa0e91d284d7f1ebf"},{"fixed":"ceebe641a1562c694898eeafef794eec40b90522"},{"introduced":"883b289c40e347a45878306997fc3dc9e7e11523"},{"last_affected":"883b289c40e347a45878306997fc3dc9e7e11523"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","range":[{"introduced":"7.0.0"},{"fixed":"18.11.13"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","range":[{"introduced":"7.0.0"},{"fixed":"18.11.13"}]},{"range":[{"introduced":"19.0.0"},{"fixed":"19.0.10"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*"},{"cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","range":[{"introduced":"19.0.0"},{"fixed":"19.0.10"}],"source":"CPE_RANGE"},{"range":[{"introduced":"19.1.0"},{"fixed":"19.1.9"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*"},{"cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","range":[{"introduced":"19.1.0"},{"fixed":"19.1.9"}],"source":"CPE_RANGE"},{"range":[{"introduced":"19.2.0"},{"fixed":"19.2.9"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","range":[{"introduced":"19.2.0"},{"fixed":"19.2.9"}]},{"cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","range":[{"introduced":"19.3.0"},{"fixed":"19.3.6"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","range":[{"introduced":"19.3.0"},{"fixed":"19.3.6"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","range":[{"introduced":"19.4.0"},{"fixed":"19.4.3"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","range":[{"introduced":"19.4.0"},{"fixed":"19.4.3"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:community:*:*:*","range":[{"introduced":"19.5.0"},{"last_affected":"19.5.0"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*","range":[{"introduced":"19.5.0"},{"last_affected":"19.5.0"}],"source":"CPE_STRING"}]}}],"versions":["19.5.0","v18.11.12-ee","v19.0.9-ee","v19.5.0-ee","v19.4.0-ee","v19.3.0-ee","v18.11.9-ee","v18.11.8-ee","v19.1.0-ee","v19.2.0-ee","v19.0.0-ee","v18.11.2-ee","v18.11.0-ee","v18.11.0-rc42-ee","v18.11.0-rc43-ee","11-10-0cfa69752d8-74ffd66ae-ee","11-10-0cfa69752d8-0d9531c80-ee","11-10-119f9509d50-6d7537235-ee","v7.3.0-ee","v7.3.0.rc1-ee","v7.2.0.rc5-ee","v7.2.0.rc4-ee","v7.2.0.rc3-ee","v7.2.0.rc2-ee","v7.2.0.rc1-ee","v7.1.0-ee","v7.1.0.rc1-ee","v7.0.0-ee"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110264.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}