Admins who thought they were done with GitLab patches on October 12 are not. A maximum-severity hole granting unauthenticated remote code execution on self-managed installs reaches all the way back to version 7.0 from 2014, and GitLab pulled the affected releases on October 21.
CVE-2026-110264 scores 10.0 on CVSS. An integer overflow during compilation of a specially crafted regular expression causes it, and GitLab has not said what an attacker must arrange to trigger it. Because the server compiles that regex on its own initiative, no login is involved.
Timing is what makes this awkward. The October 12 update addressed versions 19.2 and newer, yet the builds that close this hole sit one patch above those, so a box updated nine days ago is again in range. Seven release branches received fixes together. GitLab.com runs the corrected build already, and Dedicated customers on 19.3.5-internal0 or 19.4.2-internal0 and later are covered.
Operators of self-managed instances should apply the new patch release now. No workaround exists at the configuration level, so patching is the only real answer. When an upgrade cannot happen tonight, cut the instance off from the wider network behind a VPN or an allowlist, then inspect it for evidence that someone reached the regex path ahead of you.
