GITLAB CRITICAL PATCHES INCLUDE ONE FOR A BUG THAT ALLOWS CODE EXECUTION BY UNAUTHENTICATED USERS

Summary from the TLDR InfoSec newsletter

GitLab released patches for 12 issues, including CVE-2026-110264, a critical integer-overflow flaw in its regular-expression compiler. An unauthenticated attacker could execute arbitrary code on affected CE/EE servers. Fixes cover versions 18.11.13 through 19.5.1. Affected releases date back to 7.0. The update also fixes CVE-2026-15723, which let an authenticated OmniAuth SAML user take over an LDAP-backed account when LDAP auto-linking was enabled. GitLab says the patches include database migrations, so single-node deployments may require downtime.