Security response · October 2026
GitLab CVE-2026-110264 fixed versions and upgrade checklist
A GitLab upgrade ticket needs a clear target, a supported route to that target, and evidence from the serving instance. Use this guide to distinguish the named RCE fix from the rest of the security release.
Incident guidance can change. Use the linked vendor notices for current scope and instructions.
Quick answer
For CVE-2026-110264, match your self-managed GitLab release to the RCE fix table below, follow the supported upgrade path, and verify the serving instance. An older-branch RCE backport does not establish that all the other issues in the same security announcement are fixed.
What does CVE-2026-110264 allow
GitLab describes an integer overflow in regular expression compilation that could permit unauthenticated code execution under certain conditions. The CVSS v3.1 score is 10.0. GitLab says its managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched. GitLab critical patch notice.
Which GitLab releases contain the RCE fix
| Branch | Release containing the CVE-2026-110264 fix |
|---|---|
| 18.11 | 18.11.13 |
| 19.0 | 19.0.10 |
| 19.1 | 19.1.9 |
| 19.2 | 19.2.9 |
| 19.3 | 19.3.6 |
| 19.4 | 19.4.3 |
| 19.5 | 19.5.1 |
GitLab's affected scope starts at 7.0; branches older than this table are not exempt. The older-branch backports named here address this RCE. Other entries in the same security release list fixes in 19.3.6, 19.4.3, and 19.5.1. Do not treat an RCE backport as proof that every issue in the release is fixed. Affected ranges and security fix details.
Choose a supported target that addresses the issues relevant to your installation, following the current vendor guidance. Recheck the release notice before starting because newer patch releases can supersede this dated table.
Three different claims an upgrade record must distinguish
| Claim | Evidence needed |
|---|---|
| This instance received the CVE-2026-110264 fix | Installed serving release matched to the RCE advisory |
| This instance has the other applicable security fixes | Review of each relevant advisory and its patched release range |
| This instance was not compromised before the upgrade | A separate investigation of available activity evidence; a patch version alone cannot establish this |
Keep each claim scoped to its evidence. This avoids treating a successful patch as an answer to the entire incident investigation.
How should you plan an older installation upgrade
Start with the exact current edition, version, installation method, and topology. Follow GitLab's required upgrade stops and wait for background migrations between steps. GitLab recommends the latest available patch at a required stop, rather than its first patch. GitLab upgrade path documentation.
An emergency does not make an unsupported jump safe. Assign an operator to the upgrade, a person to confirm the resulting instance, and an owner for any access restriction needed while the work is underway. Keep the current backup and recovery procedure with the change record.
What must be checked beyond the main web page
Use an instance inventory rather than a single screenshot:
| Item to record | Question to answer |
|---|---|
| Serving nodes or pods | Which deployment and package does each use? |
| Background work | Did required migrations complete before the next step? |
| Replicas and recovery environments | Could a failover reintroduce the previous version? |
| Administrative access | Who can confirm the installed version and deployment state? |
| User workflows | Do sign-in, repository access, merge requests, and a representative pipeline work? |
| Rollback plan | What would restore service without silently restoring the vulnerable release? |
Record “not applicable” with a reason for components your installation does not have. This table is a verification aid, not a claim that every component has the same exposure to the CVE.
How do you review possible exploitation
Keep the package update and incident investigation as separate work items. Consult the exploitation-attempt detections linked by GitLab and preserve the relevant application, access, and infrastructure logs before retention windows expire. The detection links are available in the CVE section of the patch notice.
An alert deserves investigation; an absence of alerts has meaning only within the detection's coverage and available history. Have the responder record what was reviewed, the time range, the result, and anything that could not be assessed. If compromise is suspected, include identities and secrets reachable from the instance in that investigation.
What evidence closes the upgrade
Copy this record into the change ticket:
- Instance and responsible operator:
- Previous version and installation method:
- Target version and vendor advisory:
- Required upgrade stops completed:
- Background migration completion evidence:
- Serving deployment/package evidence:
- Functional checks and results:
- Exposure investigation owner and status:
- Recovery and rollback constraints:
- Completion time in UTC:
“The merge request is merged” is evidence of a code change. The closure record also needs the running state of the instance.
Does an app scan replace the GitLab upgrade
A scan of your public app does not establish the patch level of a separate GitLab installation or review its incident history. Use the GitLab vendor tools and your infrastructure evidence for that job. For the application you ship through GitLab, the live app versus source review guide explains how to verify different kinds of security claims.
Questions instance owners ask
Does this require a GitLab.com customer upgrade
GitLab says GitLab.com was already patched. Its release notice identifies Dedicated builds 19.3.5-internal0 and 19.4.2-internal0 or later as including the fixes. Confirm the applicable build with your managed-service operator; the upgrade workflow here is for a self-managed instance.
Can I jump directly from an old branch to the newest release
Use GitLab's upgrade-path guidance for your installation. Required stops and background migrations still apply. Record the completed path as well as the final version, and use the latest appropriate patch at a required stop.
Cite this guide
Vibe App Scanner. “GitLab CVE-2026-110264 fixed versions and upgrade checklist.” Technical sources reviewed 22 October 2026. The RCE fix table is attributed to GitLab; the closure record is an operational template.