The release fixes CVE-2026-110264, an integer-overflow issue in the regular-expression compiler. GitLab says that, under certain conditions, an unauthenticated user could execute arbitrary code on a GitLab server with a specially crafted regular expression. The vulnerability is rated CVSS 10.0.
Affected releases include CE/EE versions from 7.0 before 18.11.13, plus releases before the stated patch version in the 19.0 through 19.5 branches. GitLab says GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later do not need action; self-managed installations should upgrade. The company also published two detections for attempted exploitation. The release notice does not establish that the flaw has been exploited in the wild.