Security Alert - GitLab Remote Code Execution Vulnerability (CVE‑2026‑110264)

GitLab has released security updates to fix a critical vulnerability in its Regular Expression Compiler, identified as CVE‑2026‑110264, which allows unauthenticated attackers to execute code on self‑hosted GitLab environments.

Affected Systems

• GitLab Community Edition (CE) and Enterprise Edition (EE):  versions prior to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

Security Risks

The vulnerability has a CVSS base score of 10.0 (Critical). Exploitation could lead to full server compromise, exposure of sensitive data, and disruption of services.

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

1. Upgrade GitLab to a fixed version as soon as possible to address the critical vulnerability and protect affected servers from exploitation.

      
   The recommended software versions to upgrade to are:

• GitLab Community Edition (CE) and Enterprise Edition (EE): upgrade to versions 19.5.1 or above, 19.4.3 or above, 19.3.6 or above, 19.2.9 or above, 19.1.9 or above, 19.0.10 or above, and 18.11.13 or above

2. Before performing any update tasks, ensure that you have a backup of your data.

For further information and support, please contact the National Cyber Security Authority (NCSA) by email to rwcsirt@ncsa.gov.rw or call us on 9009

References

• GitLab Critical Patch Release Notes. 

• GitLab warns of new max severity code execution vulnerability 

• CVE-2026-110264