BIT-gitlab-2026-110264: Integer Overflow or Wraparound in GitLab

Q: Which GitLab versions need to be remediated?

Affected versions include all releases from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Upgrade to the applicable fixed release or later.

Q: Does an attacker need a GitLab account or user interaction to exploit this issue?

No. The issue could allow an unauthenticated attacker to execute arbitrary code on the GitLab server under certain conditions, and the supplied vector indicates no user interaction is required.

Q: What attacker input triggers the vulnerable condition?

The issue involves integer overflow while GitLab compiles a specially crafted regular expression. The provided data does not identify the specific GitLab feature, endpoint, or configuration condition through which that expression is supplied.

Published Oct 22, 2026

Updated

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Affected Software

7 affected componentsFixes available

bitnami/gitlab>=7.0.0<18.11.13

18.11.13

bitnami/gitlab>=19.0.0<19.0.10

19.0.10

bitnami/gitlab>=19.1.0<19.1.9

19.1.9

bitnami/gitlab>=19.2.0<19.2.9

19.2.9

bitnami/gitlab>=19.3.0<19.3.6

19.3.6

bitnami/gitlab>=19.4.0<19.4.3

19.4.3

bitnami/gitlab>=19.5.0<19.5.1

19.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/gitlab to a version that resolves this vulnerability.
Fixed in 18.11.13
Upgrade
Upgrade bitnami/gitlab to a version that resolves this vulnerability.
Fixed in 19.0.10
Upgrade
Upgrade bitnami/gitlab to a version that resolves this vulnerability.
Fixed in 19.1.9
Upgrade
Upgrade bitnami/gitlab to a version that resolves this vulnerability.
Fixed in 19.2.9
Upgrade
Upgrade bitnami/gitlab to a version that resolves this vulnerability.
Fixed in 19.3.6
Upgrade
Upgrade bitnami/gitlab to a version that resolves this vulnerability.
Fixed in 19.4.3
Upgrade
Upgrade bitnami/gitlab to a version that resolves this vulnerability.
Fixed in 19.5.1
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 18.11.13
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.0.10
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.1.9
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.2.9
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.3.6
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.4.3
Upgrade
Upgrade GitLab CE/EE to a version that resolves this vulnerability.
Fixed in 19.5.1

Event History

Oct 22, 2026

CVE Published

via OSV·12:33 AM

Data Sourced

via OSV·12:33 AM

DescriptionSeverityWeakness

Oct 29, 2026

Advisory Published

via OSV·09:10 AM

Data Sourced

via OSV·09:10 AM

Affected Software

Frequently Asked Questions

Which GitLab versions need to be remediated?

Affected versions include all releases from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Upgrade to the applicable fixed release or later.

Does an attacker need a GitLab account or user interaction to exploit this issue?

No. The issue could allow an unauthenticated attacker to execute arbitrary code on the GitLab server under certain conditions, and the supplied vector indicates no user interaction is required.

What attacker input triggers the vulnerable condition?

The issue involves integer overflow while GitLab compiles a specially crafted regular expression. The provided data does not identify the specific GitLab feature, endpoint, or configuration condition through which that expression is supplied.

BIT-gitlab-2026-110264: Integer Overflow or Wraparound in GitLab

Affected Software

Remediation

Event History

Frequently Asked Questions

Which GitLab versions need to be remediated?

Does an attacker need a GitLab account or user interaction to exploit this issue?

What attacker input triggers the vulnerable condition?

Company

Resources

Contact

Frequently Asked Questions

Which GitLab versions need to be remediated?

Does an attacker need a GitLab account or user interaction to exploit this issue?

What attacker input triggers the vulnerable condition?