GitLab's critical patch fixes a CVSS 10.0 unauthenticated RCE
CVE-2026-110264 is an integer overflow in GitLab's regular expression compiler that could let an unauthenticated user run code on the server. Patches are out for every supported line, with backports to older branches and two threat detections for self-managed instances.