Software management platform GitLab released security patches on October 21 to resolve a maximum-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code and gain complete control over affected servers.
The flaw received a perfect score of 10.0 on the Common Vulnerability Scoring System (CVSS), which measures the severity of software vulnerabilities. According to company disclosures, the vulnerability resides within Onigmo, a regular expression engine bundled with the Ruby programming language and included in GitLab packages. An integer overflow during regular expression compilation enables an attacker to send specially crafted inputs to compromise the system.
Broad security updates released
To address the issue, GitLab issued patches across seven different version tracks, spanning from version 18.11.13 to 19.5.1. Notably, four of these patches apply to older versions that fall outside the platform's standard software support window. GitLab typically reserves such extended backports for extraordinarily severe security threats.
This incident represents the fourth code-execution flaw discovered in GitLab's regular expression processing components within approximately one month. Security researcher "joaxcar" identified all four vulnerabilities, including a separate maximum-severity flaw (CVE-2026-97229) that was patched earlier in October. The company has not publicly detailed the specific conditions required to trigger the exploit, leaving administrators unable to mitigate risks through configuration changes alone.
Impact on self-managed servers
The cloud-hosted service GitLab.com and managed enterprise accounts on GitLab Dedicated have already been updated with the fix. Consequently, only organizations operating self-managed GitLab servers remain vulnerable until they manually apply the updates. Because no workaround exists, applying the vendor-provided patch is the sole method of protection.
In the same software release, GitLab resolved 10 additional security vulnerabilities. These include a high-severity account takeover flaw (CVSS 8.2) affecting setups utilizing both SAML and LDAP auto-linking, as well as a cache-poisoning issue (CVSS 7.5) involving OAuth and OpenID authentication workflows.
GitLab stated that there is no evidence of active exploitation in the wild, and cybersecurity agencies have not logged the bug as an actively exploited vulnerability. The platform has published detection rules within its open-source security tool framework to help administrators inspect system logs for potential attack attempts.
Aasan alfaaz mein
GitLab ne apni software mein aik buhut barra security masla wazeih kar ke usko theek kar diya hai. Iss kharabee ki wajah se koi bhi anjaan shakhs aap ke computer server par poora kabza kar sakta tha. Jo log apna GitLab server khud chalate hain unhein chahiye ke woh fawri taur par naya software update install karein. Is maslay se bachnay ka koi aur tariqa nahi hai.
