GitLab shipped a CVSS 10.0 fix for a flaw that has been in every self-managed version since 7.0
2026-10-23Security
CVE-2026-110264 is an integer overflow when compiling a crafted regular expression, and GitLab says it could have let an unauthenticated user run code on the server. The affected range starts at a version from 2014.