GitLab CVE-2026-110264

Exploitation requires reaching a GitLab CE/EE code path that compiles an attacker-supplied regular expression; the description qualifies this with 'under certain conditions,' indicating the vulnerable regex-compilation functionality must be reachable/enabled in the target deployment rather than being universally triggerable. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and the attack is network-reachable (AV:N). The primary limiting factor is the conditional nature of the vulnerable path and the version scope: affected are all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1; deployments patched to these or later releases are not exploitable.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes a network-reachable, unauthenticated, low-complexity path to code execution with scope change and full confidentiality/integrity/availability impact, scoring 10.0 - the maximum. CWE-190 (integer overflow) leading to arbitrary code execution during regex compilation is consistent with a memory-corruption RCE. A public exploit is referenced (HackerOne report #4093475), which materially raises near-term risk even though this does NOT by itself mean active exploitation. No EPSS score, SSVC decision data, or CISA KEV listing is present in the input, so exploitation-probability and automatability signals cannot be weighed - their absence is a data gap, not evidence of low risk. The one tempering signal is the description's phrase 'under certain conditions,' which implies the vulnerable regex-compilation path may not be reachable in every deployment; this slightly conflicts with the AC:L rating and should be clarified with the vendor. Given a maximal CVSS, a public PoC, and vendor (GitLab) confirmation, this warrants emergency patching.

A remote, unauthenticated attacker submits a specially crafted regular expression to a GitLab endpoint that compiles user-supplied patterns, triggering an integer overflow during compilation that corrupts memory and yields arbitrary code execution on the GitLab server. Public exploit code is referenced via a HackerOne report, lowering the barrier to reproduction. Because the attack is network-based with low complexity and no authentication, a single crafted request can compromise the host.