An integer overflow or wraparound occurs when GitLab compiles a specially crafted regular expression. The flaw allows an unauthenticated user to trigger a buffer overflow that can lead to arbitrary code execution on the GitLab server. The weakness is a classic integer overflow (CWE‑190) in a core parsing routine, giving attackers the ability to escape the confines of the regular‑expression engine and run code with the privileges of the GitLab process.

GitLab, all Community Edition and Enterprise Edition releases from 7.0 up to but not including 18.11.13, 19.0 up to but not including 19.0.10, 19.1 up to but not including 19.1.9, 19.2 up to but not including 19.2.9, 19.3 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1.

The vulnerability has a CVSS score of 10, indicating the highest severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog, but the potential for remote code execution and absence of authentication requirements make exploitation highly desirable for adversaries. The likely attack vector involves sending a maliciously constructed regular expression through an unauthenticated HTTP request to the target GitLab instance; the integer overflow is triggered during the compilation of that expression, leading to code execution.