CVE-2026-110264

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110264", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-13T18:34:15.123Z", "datePublished": "2026-10-22T00:33:48.179Z", "dateUpdated": "2026-10-30T23:20:24.882Z"}, "containers": {"cna": {"title": "Integer Overflow or Wraparound in GitLab", "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "https://gitlab.com/gitlab-org/gitlab", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "7.0", "status": "affected", "lessThan": "18.11.13", "versionType": "semver"}, {"version": "19.0", "status": "affected", "lessThan": "19.0.10", "versionType": "semver"}, {"version": "19.1", "status": "affected", "lessThan": "19.1.9", "versionType": "semver"}, {"version": "19.2", "status": "affected", "lessThan": "19.2.9", "versionType": "semver"}, {"version": "19.3", "status": "affected", "lessThan": "19.3.6", "versionType": "semver"}, {"version": "19.4", "status": "affected", "lessThan": "19.4.3", "versionType": "semver"}, {"version": "19.5", "status": "affected", "lessThan": "19.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"}, {"url": "https://hackerone.com/reports/4093475", "name": "HackerOne Bug Bounty Report #4093475", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1, or later."}], "credits": [{"lang": "en", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-10-22T00:33:48.179Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-21T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-110264"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T23:05:04.898Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-30T23:20:24.882Z"}, "references": [{"url": "https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-30T23:20:24.882Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110264", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-22T12:50:08.716294Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T12:50:13.522Z"}}], "cna": {"title": "Integer Overflow or Wraparound in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "https://gitlab.com/gitlab-org/gitlab", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "7.0", "lessThan": "18.11.13", "versionType": "semver"}, {"status": "affected", "version": "19.0", "lessThan": "19.0.10", "versionType": "semver"}, {"status": "affected", "version": "19.1", "lessThan": "19.1.9", "versionType": "semver"}, {"status": "affected", "version": "19.2", "lessThan": "19.2.9", "versionType": "semver"}, {"status": "affected", "version": "19.3", "lessThan": "19.3.6", "versionType": "semver"}, {"status": "affected", "version": "19.4", "lessThan": "19.4.3", "versionType": "semver"}, {"status": "affected", "version": "19.5", "lessThan": "19.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1, or later."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"}, {"url": "https://hackerone.com/reports/4093475", "name": "HackerOne Bug Bounty Report #4093475", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-10-22T00:33:48.179Z"}}}, "cveMetadata": {"cveId": "CVE-2026-110264", "state": "PUBLISHED", "dateUpdated": "2026-10-30T23:20:24.882Z", "dateReserved": "2026-10-13T18:34:15.123Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-10-22T00:33:48.179Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "https://gitlab.com/gitlab-org/gitlab", "vendor": "GitLab", "versions": [{"lessThan": "18.11.13", "status": "affected", "version": "7.0", "versionType": "semver"}, {"lessThan": "19.0.10", "status": "affected", "version": "19.0", "versionType": "semver"}, {"lessThan": "19.1.9", "status": "affected", "version": "19.1", "versionType": "semver"}, {"lessThan": "19.2.9", "status": "affected", "version": "19.2", "versionType": "semver"}, {"lessThan": "19.3.6", "status": "affected", "version": "19.3", "versionType": "semver"}, {"lessThan": "19.4.3", "status": "affected", "version": "19.4", "versionType": "semver"}, {"lessThan": "19.5.1", "status": "affected", "version": "19.5", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "8B45421D-ED7D-487B-98BD-43CAA3C88BA0", "versionEndExcluding": "18.11.13", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "6A03B0E7-328C-4C44-916A-85CFE9D9BA80", "versionEndExcluding": "18.11.13", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "2C4108E3-EB4F-48D6-8F20-0A2B1D5E9115", "versionEndExcluding": "19.0.10", "versionStartIncluding": "19.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "4EFE1554-408D-42C4-BBB4-C34658876749", "versionEndExcluding": "19.0.10", "versionStartIncluding": "19.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "217B9C55-74EA-4426-AACA-67D28FE25E00", "versionEndExcluding": "19.1.9", "versionStartIncluding": "19.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "21D36A05-90F9-4BFC-8DF3-00DFFED1D4FC", "versionEndExcluding": "19.1.9", "versionStartIncluding": "19.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "8F77C7C3-C3CF-4022-BAD7-3120A27CB2E4", "versionEndExcluding": "19.2.9", "versionStartIncluding": "19.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "CC6F3A8E-AD1C-4D0F-9B76-98016C4CB50E", "versionEndExcluding": "19.2.9", "versionStartIncluding": "19.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "1C6DA244-D06B-41AB-9FD8-8AE2CCC0EBCB", "versionEndExcluding": "19.3.6", "versionStartIncluding": "19.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "B3ACA3C1-C2F5-4C9D-BBD7-580D00ECE913", "versionEndExcluding": "19.3.6", "versionStartIncluding": "19.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "12A85E28-FB9B-477D-BE6F-DE307EFEB4E0", "versionEndExcluding": "19.4.3", "versionStartIncluding": "19.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "30C796E1-40AA-41AF-8186-A49F78DC528D", "versionEndExcluding": "19.4.3", "versionStartIncluding": "19.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:community:*:*:*", "matchCriteriaId": "2032C266-304B-4C69-95CA-56904EA5A64F", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "7D6BE6DD-CA49-4E20-9541-22477632BA5D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 7.0 y anteriores a la 18.11.13, la 19.0 y anteriores a la 19.0.10, la 19.1 y anteriores a la 19.1.9, la 19.2 y anteriores a la 19.2.9, la 19.3 y anteriores a la 19.3.6, la 19.4 y anteriores a la 19.4.3, y la 19.5 y anteriores a la 19.5.1 que, bajo ciertas condiciones, podr\u00eda haber permitido a un usuario no autenticado ejecutar c\u00f3digo arbitrario en el servidor de GitLab debido a un desbordamiento de entero al compilar una expresi\u00f3n regular especialmente dise\u00f1ada."}], "id": "CVE-2026-110264", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110264", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-21T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-10-22T01:16:57.603", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633633"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/4093475"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ruby: integer overflow issue in regular expression compiler", "id": "2558632", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558632"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.", "A flaw was found in Ruby. When compiling a specially crafted regular expression containing an excessive number of repeats with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /#{input}/, an integer overflow of internal IDs can occur. This integer overflow causes memory corruption, potentially resulting in arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, do not compile regular expressions from untrusted sources. Standard safeguards such as Regexp.timeout or limiting the length of the input pattern do not protect against this issue."}, "name": "CVE-2026-110264", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ruby4.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "ruby:2.5/ruby", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "ruby:3.3/ruby", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "ruby:3.3/ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "ruby:4.0/ruby", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "hi/ruby", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby3.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby3.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby4.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-22T00:33:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110264\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110264\nhttps://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/\nhttps://gitlab.com/gitlab-org/gitlab/-/work_items/633633\nhttps://hackerone.com/reports/4093475\nhttps://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/"], "statement": "This flaw is only exploitable in applications compiling regular expressions from a string that is controlled by an attacker, for example, by passing it to the methods Regexp.new, Regexp.union or Regexp.compile, or by interpolating it into a regexp literal such as /#{input}/. Applications that only use hardcoded regular expressions are not vulnerable to this issue.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0,18.11.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.0,19.0.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.1,19.1.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.2,19.2.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.3,19.3.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.4,19.4.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[19.5,19.5.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GitLab", "source": "cna", "vendor": "GitLab"}, "product": "gitlab", "vendor": "gitlab"}], "created": "2026-10-22T06:00:12.833910+00:00", "updated": "2026-10-22T06:00:14.283385+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}