GitLab 于周三修复了一个最高严重级别的漏洞，该漏洞在特定条件下可能允许未经身份验证的攻击者在自托管服务器上执行任意代码。受影响的软件版本可追溯至 12 年前 —— 请立即升级到已修复的版本。
GitLab on Wednesday patched a maximum-severity flaw that could allow unauthenticated attackers to execute arbitrary code on self-managed servers under certain conditions. Affected software releases date back a full 12 years - so upgrade to a fixed version now.
该整数溢出漏洞，编号为 CVE-2026-110264，影响 GitLab 社区版（CE）和企业版（EE）中的正则表达式编译，涉及的版本可追溯至 2014 年 6 月发布的 GitLab 7.0。供应商在发行说明中表示，该缺陷“在特定条件下，可能允许未经身份验证的用户因编译特制正则表达式时发生整数溢出，而在 GitLab 服务器上执行任意代码”。
The integer overflow bug, tracked as CVE-2026-110264, affects regular-expression compilation in GitLab Community Edition (CE) and Enterprise Edition (EE), including versions dating back to GitLab 7.0, released in June 2014. The flaw, “under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,” the vendor said in its release notes.
GitLab 在 19.5.1、19.4.3 和 19.3.6 版本中发布了修复，并将补丁回溯至 19.2.9、19.1.9、19.0.10 和 18.11.13 版本。供应商“强烈建议”所有运行易受攻击软件的组织“尽快”升级到已修复的版本。
GitLab released fixes in versions 19.5.1, 19.4.3, and 19.3.6, and backported the patch to versions 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The vendor “strongly recommends” that all organizations running vulnerable software upgrade to a fixed version “as soon as possible.”
GitLab 托管的基础设施（包括 GitLab.com 和 GitLab Dedicated）已完成修补，供应商还为拥有自托管实例的客户发布了两条威胁检测规则（见此处和此处）。
GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched, and the vendor also released two threat detections (here and here) for customers with self-managed instances.
漏洞猎人 Johan Carlsson 通过 GitLab 的 HackerOne 漏洞赏金计划报告了该漏洞。
Bug hunter Johan Carlsson reported the vulnerability through GitLab’s HackerOne bug bounty program.
威胁检测公司 SOC Prime 警告称：“对于运行自托管 GitLab 基础设施的组织而言，潜在影响极为严重。GitLab 代码库通常包含源代码、CI/CD 配置、部署密钥、访问令牌、基础设施定义以及与生产环境的连接。服务器级别的沦陷因此可能导致凭证窃取、代码库篡改、供应链攻击、持久化驻留或横向移动。”
“For organizations running self-managed GitLab infrastructure, the potential impact is severe,” warned threat-detection firm SOC Prime.
虽然目前尚无迹象表明存在实际利用尝试，但我们预计犯罪分子很快就会开始扫描易受攻击的实例。
“GitLab repositories frequently contain source code, CI/CD configuration, deployment secrets, access tokens, infrastructure definitions, and connections to production environments. Server-level compromise could therefore create opportunities for credential theft, repository manipulation, supply chain attacks, persistence, or lateral movement.”
正在进行的 PHP 混乱可能让防御者在这个问题上获得了短暂的先机，但考虑到完美的 10 分 CVSS 严重性评级以及 GitLab 在企业级市场的覆盖面——它声称拥有 5000 万注册用户，且超过 50% 的《财富》100 强企业在使用——这种优势不会持续太久。根据美国网络安全和基础设施安全局以及私营研究人员的说法，上个月，攻击者在供应商发布补丁仅几天内，就开始猛烈攻击同一 GitLab CE 和 EE 产品中的另一个最高严重性漏洞。®
While there’s no indication - yet - of any in-the-wild exploitation attempts, we’d expect criminals to start scanning for vulnerable instances soon. The ongoing PHP chaos may have given defenders a short head-start on this one, but considering the perfect 10 CVSS severity rating and GitLab’s reach into the enterprise - it claims 50 million registered users and more than 50 percent of the Fortune 100 - that’s not going to last long. Last month, attackers started battering another max-severity flaw in the same GitLab CE and EE products just days after the vendor issued a patch, according to the US Cybersecurity and Infrastructure Security Agency and private researchers.®