GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.

This security issue is tracked as CVE-2026–110264 and was reported by a security researcher using the ‘joaxcar’ handle through GitLab’s HackerOne bug bounty program.

CVE-2026–110264 stems from an integer overflow weakness in GitLab’s Regular Expression Compiler, a background engine that parses and validates regular expressions in configuration files.