CVE-2026-110264 Integer Overflow or Wraparound in GitLab
CriticalCVSS 10.0
EPSS 1.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitlab | >= 7.0, < 18.11.13 | 18.11.13 |
| gitlab | >= 19.0, < 19.0.10 | 19.0.10 |
| gitlab | >= 19.1, < 19.1.9 | 19.1.9 |
| gitlab | >= 19.2, < 19.2.9 | 19.2.9 |
| gitlab | >= 19.3, < 19.3.6 | 19.3.6 |
| gitlab | >= 19.4, < 19.4.3 | 19.4.3 |
| gitlab | >= 19.5, < 19.5.1 | 19.5.1 |
| azure linux ruby(Azure Linux:3.0) | < 3.3.13-0 | 3.3.13-0 |
| redhat/ruby4.0(Red Hat:enterprise_linux:10.2) | < 4.0.9-38.el10_2 | 4.0.9-38.el10_2 |
| redhat/ruby(Red Hat:enterprise_linux:10.2) | < 3.3.13-16.el10_2 | 3.3.13-16.el10_2 |
| redhat/ruby(Red Hat:enterprise_linux:9) | < 3.0.7-170.el9_8 | 3.0.7-170.el9_8 |
| redhat/ruby:3.3-9080020261105110750.9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/ruby:4.0-9080020261105110139.9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/openvox-agent(Red Hat:satellite:6.16::el8) | < 8.32.0-1.el8sat | 8.32.0-1.el8sat |
| redhat/python-pyyaml(Red Hat:satellite:6.16::el8) | < 6.0.1-1.el8pc | 6.0.1-1.el8pc |
| redhat/openvox-agent(Red Hat:satellite_capsule:6.16::el8) | < 8.32.0-1.el8sat | 8.32.0-1.el8sat |
| redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el8) | < 6.0.1-1.el8pc | 6.0.1-1.el8pc |
| redhat/openvox-agent(Red Hat:satellite:6.16::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/python-pyyaml(Red Hat:satellite:6.16::el9) | < 6.0.1-1.el9pc | 6.0.1-1.el9pc |
| redhat/openvox-agent(Red Hat:satellite_capsule:6.16::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/python-pyyaml(Red Hat:satellite_capsule:6.16::el9) | < 6.0.1-1.el9pc | 6.0.1-1.el9pc |
| redhat/openvox-agent(Red Hat:satellite:6.17::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-agent(Red Hat:satellite_capsule:6.17::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-agent(Red Hat:satellite:6.18::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-agent(Red Hat:satellite_capsule:6.18::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
Show 37 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/openvox-agent(Red Hat:satellite:6.19::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/openvox-agent(Red Hat:satellite_capsule:6.19::el9) | < 8.32.0-1.el9sat | 8.32.0-1.el9sat |
| redhat/ruby3-4-main(Red Hat:hummingbird:1) | < 3.4.12-33.1.hum1 | 3.4.12-33.1.hum1 |
| redhat/ruby4-0-main(Red Hat:hummingbird:1) | < 4.0.9-41.hum1 | 4.0.9-41.hum1 |
| redhat/ruby3-3-main(Red Hat:hummingbird:1) | < 3.3.13-23.8.hum1 | 3.3.13-23.8.hum1 |
| redhat/ruby(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/ruby(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/ruby:2.5/ruby(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/ruby:3.3/ruby(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| debian/ruby3.1(Debian:12) | All versions | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-7 | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-7+deb12u1 | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-7+hurd.1 | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-8 | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-8.1~exp1 | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-8.3 | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-8.4 | No fix listed |
| debian/ruby3.1(Debian:12) | = 3.1.2-8.5 | No fix listed |
| debian/ruby3.3(Debian:13) | < 3.3.13-0+deb13u1 | 3.3.13-0+deb13u1 |
| debian/ruby3.3(Debian:13) | = 3.3.8-2 | No fix listed |
| debian/ruby3.3(Debian:13) | = 3.3.8-2.1 | No fix listed |
| debian/ruby3.3(Debian:13) | = 3.3.8-2.2 | No fix listed |
| debian/ruby3.3(Debian:14) | All versions | No fix listed |
| debian/ruby3.3(Debian:14) | = 3.3.8-2 | No fix listed |
| debian/ruby3.3(Debian:14) | = 3.3.8-2.1 | No fix listed |
| debian/ruby3.3(Debian:14) | = 3.3.8-2.2 | No fix listed |
| alpine/ruby(Alpine:v3.21) | < 3.3.13-r0 | 3.3.13-r0 |
| alpine/ruby(Alpine:v3.22) | < 3.4.12-r0 | 3.4.12-r0 |
| alpine/ruby(Alpine:v3.23) | < 3.4.12-r0 | 3.4.12-r0 |
| alpine/ruby(Alpine:v3.24) | < 3.4.12-r0 | 3.4.12-r0 |
| gitlab | >= 7.0.0, < 18.11.13 | 18.11.13 |
| gitlab | >= 19.0.0, < 19.0.10 | 19.0.10 |
| gitlab | >= 19.1.0, < 19.1.9 | 19.1.9 |
| gitlab | >= 19.2.0, < 19.2.9 | 19.2.9 |
| gitlab | >= 19.3.0, < 19.3.6 | 19.3.6 |
| gitlab | >= 19.4.0, < 19.4.3 | 19.4.3 |
| gitlab | = 19.5.0 | No fix listed |
References
- gitlab.com permissions-required
- HackerOne Bug Bounty Report #4093475 exploit permissions-required technical-description
- docs.gitlab.com release-notes vendor-advisory
- www.ruby-lang.org
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:96233 patch vendor-advisory
- RHSA-2026:96235 patch vendor-advisory
- RHSA-2026:96067 patch vendor-advisory
- RHSA-2026:96068 patch vendor-advisory
- RHSA-2026:96120 patch vendor-advisory
- RHSA-2026:95655 patch vendor-advisory
- RHSA-2026:95656 patch vendor-advisory
- RHSA-2026:95657 patch vendor-advisory
- RHSA-2026:95652 patch vendor-advisory
- RHSA-2026:88861 patch vendor-advisory
- RHSA-2026:88865 patch vendor-advisory
- RHSA-2026:88880 patch vendor-advisory
- Red Hat Bugzilla 2558632 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-110264 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking