{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2026-019.pdf"
    },
    "title": "Critical Vulnerability in GitLab Community and Enterprise Editions",
    "serial_number": "2026-019",
    "publish_date": "22-10-2026 09:14:22",
    "description": "On 21 October 2026, GitLab published a security advisory addressing several vulnerabilities among which a critical flaw that could allow an unauthenticated user to execute arbitrary code on a GitLab server.<br>\nCERT-EU recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets.<br>\n",
    "url_title": "2026-019",
    "content_markdown": "---    \ntitle: 'Critical Vulnerability in\u00a0GitLab\u00a0Community and\u00a0Enterprise\u00a0Editions'\nnumber: '2026-019'\nversion: '1.0'\noriginal_date: '2026-10-21'\ndate: '2026-10-22'\n---\n\n_History:_\n\n* _22/10/2026 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn 21 October 2026, GitLab published a security advisory addressing several vulnerabilities among which a critical flaw that could allow an unauthenticated user to execute arbitrary code on a GitLab server [1].\n\nCERT-EU recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets.\n\n# Technical Details\n\nThe vulnerability **CVE-2026-110264**, with a CVSS score of 10, is a critical integer overflow vulnerability within the regular expression compiler which could allow an unauthenticated user to execute arbitrary code on the affected GitLab server.\n\nGitLab also fixed 2 high severity, 5 medium severity and 4 low severity vulnerabilities [1].\n\n# Affected Products\n\nThe vulnerability **CVE-2026-110264** affects the following versions of GitLab\u00a0Community\u00a0and\u00a0Enterprise\u00a0Editions [1]:\n\n- from 7.0 before 18.11.13\n- 19.0 before 19.0.10\n- 19.1 before 19.1.9\n- 19.2 before 19.2.9\n- 19.3 before 19.3.6\n- 19.4 before 19.4.3\n- 19.5 before 19.5.1\n\n# Recommendations\n\nCERT-EU recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets.\n\n## Compromise assessment\n\nGitLab has published two detection rules to identify exploitation attempts [1, 2, 3].\n\n# References\n\n[1] <https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/>\n\n[2] <https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md?ref_type=heads>\n\n[3] <https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md?ref_type=heads>",
    "content_html": "<p><em>History:</em></p><ul><li><em>22/10/2026 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On 21 October 2026, GitLab published a security advisory addressing several vulnerabilities among which a critical flaw that could allow an unauthenticated user to execute arbitrary code on a GitLab server [1].</p><p>CERT-EU recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets.</p><h2 id=\"technical-details\">Technical Details</h2><p>The vulnerability <strong>CVE-2026-110264</strong>, with a CVSS score of 10, is a critical integer overflow vulnerability within the regular expression compiler which could allow an unauthenticated user to execute arbitrary code on the affected GitLab server.</p><p>GitLab also fixed 2 high severity, 5 medium severity and 4 low severity vulnerabilities [1].</p><h2 id=\"affected-products\">Affected Products</h2><p>The vulnerability <strong>CVE-2026-110264</strong> affects the following versions of GitLab\u00a0Community\u00a0and\u00a0Enterprise\u00a0Editions [1]:</p><ul><li>from 7.0 before 18.11.13</li><li>19.0 before 19.0.10</li><li>19.1 before 19.1.9</li><li>19.2 before 19.2.9</li><li>19.3 before 19.3.6</li><li>19.4 before 19.4.3</li><li>19.5 before 19.5.1</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets.</p><h3 id=\"compromise-assessment\">Compromise assessment</h3><p>GitLab has published two detection rules to identify exploitation attempts [1, 2, 3].</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/\">https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md?ref_type=heads\">https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md?ref_type=heads</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md?ref_type=heads\">https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md?ref_type=heads</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}