GitLab CVE‑2026‑97229 Exploited: Upgrade to 19.5.4, 19.4.6 or 19.3.8

GitLab Upgrade Targets per Line After the November 10 Critical Patch #

Four patch batches set today's targets: 19.4.2, 19.3.5 and 19.2.8 on October 12, 19.5.1, 19.4.3 and 19.3.6 with backports down to 18.11.13 on October 21, 19.5.3 and six older lines on October 29, and the critical 19.5.4, 19.4.6 and 19.3.8 on November 10. Releases on one line are cumulative, so 19.5.4, 19.4.6 and 19.3.8 each close all three critical flaws. On 19.2 and older, even the newest release sits inside the CVE-2026-105437 range, so the target is a move to 19.3.8 or later.

Two Critical Regex Overflows: CI/CD Configurations and Every Line Since 7.0 #

CVE-2026-97229 is an integer overflow in the CI/CD Regular Expression Compiler, caused by insufficient regular expression validation. GitLab gives it CVSS 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, with no privileges and no user interaction. The CVE-2026-97229 record adds that CISA's SSVC assessment rated exploitation as active on October 13, the day after the fix and 16 days before the KEV entry. Its range covers only 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2.

Nine days later the 19.5.1 page fixed CVE-2026-110264, an integer overflow when compiling a specially crafted regular expression, with the same CVSS 10.0 vector and the same reporter, joaxcar, through HackerOne. Its range is much wider: all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. The standard patch releases are 19.5.1, 19.4.3 and 19.3.6; GitLab backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 in addition, so 19.5 is affected too, not only the older lines.

The same page says the fix for CVE-2026-110264 is a patch to Ruby, not to GitLab code, and that only the official GitLab Linux packages and container images include it. A self-compiled installation or a custom container image that runs its own Ruby must also upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later; upgrading GitLab alone leaves it exposed. The October 12 releases carried Ruby patches as well: the bug-fix lists of 19.4.2, 19.3.5 and 19.2.8 each add a Ruby regexp program size patch and a repeat-range double-free patch for Ruby 3.3 and 3.4.

CVE-2026-105437: A Git Overflow in Gitaly With No Fix Below 19.3 #

The November 10 critical patch fixes CVE-2026-105437 by updating the Git bundled with GitLab. GitLab rates it Critical: under certain conditions the flaw can result in out-of-bounds heap writes that could be used to execute arbitrary commands within GitLab's Gitaly environment. The impacted versions are all versions from 16.2 before 19.3.8, 19.4 before 19.4.6 and 19.5 before 19.5.4, and the patch shipped for 19.5, 19.4 and 19.3 only. An instance on 19.2, 19.1, 19.0 or 18.11 stays inside the range on its newest release, including 19.2.10 and 18.11.14 from October 29.

The CVE-2026-105437 record, which GitLab published for Git itself, gives a lower CVSS 3.1 base score of 7.5, with the vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. It explains the mechanism: Git's three-way merge code kept the size of the merged output in a 32-bit signed integer, and the conflict-marker-size attribute, which a committed .gitattributes file can set, lets a small file with a huge marker size and many separate conflicts push that total past 4 GiB, so Git writes attacker-controlled output past the end of its buffer. The record names git merge-tree, which Git forges may run on the server to check mergeability, as the most likely target: when the server reads attributes from the repository's trees, any user who can push branches and request a merge can trigger it without anyone else doing anything.

Official Linux packages and container images already include the patched Git. For self-compiled installations, the 19.5.4 page asks for two rebuilds: the Update Gitaly steps, which rebuild the Git binaries embedded in Gitaly, and the Git that git.bin_path in config/gitlab.yml points to, rebuilt from the matching Gitaly stable branch. When that Git comes from the distribution's package, it must be 2.56.1 or later, or a version the distribution patched for CVE-2026-105437.

eMudhra Certificate Distrust: GitLab Runner and AI Gateway Need Their Own Updates #

On October 29, GitLab released 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11 and 18.11.14, which remove trust for eight eMudhra intermediate CA certificates with compromised private keys from the certificate stores that GitLab ships. GitLab files the change under CVE-2026-111943, an identifier from Go: its record describes a denylist in Go's crypto/x509 that rejects those intermediates, fixed in Go 1.26.10 and 1.27.3, with a CVSS 3.1 score of 6.8 assigned by CISA-ADP. The GitLab bug-fix lists bump Go to 1.27.3 or 1.26.10 and the bundled cacerts to 2026-10-20.

GitLab Runner and the AI Gateway verify certificates on their own, so upgrading GitLab does not update either of them. The page requires self-hosted GitLab Runner 19.5.1, a rebuild of any CI/CD job images that include their own ca-certificates package, and a self-hosted AI Gateway on 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3 or later. GitLab Dedicated tenants on 19.4.3-internal0 or later already have the change. GitLab skipped the numbers 19.5.2 and 19.4.4, so no releases carry them.

Sign-In, CI/CD and Browser Fixes GitLab Rates High #

Instances that link OmniAuth sign-ins to LDAP or sit behind a shared cache get two High fixes from the October 21 releases, shipped on 19.5.1, 19.4.3 and 19.3.6 only. With OmniAuth SAML and LDAP auto-linking both enabled, CVE-2026-15723 (CVSS 8.2, from 10.1) let an authenticated user take over an existing LDAP-backed account without any interaction from the targeted user, through improper input sanitization in the LDAP email lookup. CVE-2026-112212 (CVSS 7.5, from 18.3) let an unauthenticated user, under certain conditions, poison a shared cache's OAuth/OIDC discovery document and redirect certain flows to an externally controlled server. Their ranges, like those of every October 21 fix except CVE-2026-110264, run up to 19.3.6, and no 19.2 release lists them, so a 19.2 instance stays exposed to them.

Three High fixes from the October 12 releases concern who can run pipelines and what the pipelines run. CVE-2026-16301 (CVSS 8.5, from 18.7) let a user with the Developer role run CI/CD pipelines on protected branches through the downstream pipeline creation service. CVE-2026-14814 (CVSS 8.2, all versions before 19.2.8) let a user poison cached responses for raw repository files, so targeted users' pipelines could run crafted content and potentially expose protected environment variables. In EE, CVE-2026-81839 (CVSS 7.7, from 18.1) let a user run pipelines in a transferred project with the new group's privileges, because scheduled pipeline execution policy records were not cleaned up.

CVE-2026-92883 (CVSS 8.7) is cross-site scripting through a specially crafted repository: HTML attributes in syntax-highlighted output were not sanitized, so JavaScript could run in other users' browser sessions. Its record lists all versions from 19.1 before 19.2.8, so no 19.1 release fixes it; 19.2.8 is the first fixed release. The same holds for every October 12 fix: no release on 19.1 or an older line carries it. In EE, CVE-2026-96893 (CVSS 7.3, from 19.1) let an authenticated user inject crafted content into AI agent instructions in GitLab Duo Agent Platform, potentially causing command execution attributed to other users.

Medium and Low Fixes: Unauthenticated Reads, Tokens and EE Controls #

The other 27 fixes mostly let a user read or change what their role or token should not reach. GitLab describes four as reachable by an unauthenticated user: CVE-2026-105777, CVE-2026-16275, CVE-2026-84284 and CVE-2026-85529. For CVE-2026-84284 the 19.4.2 page listed all 19.3 versions as affected; its record now gives 19.3 before 19.3.6, so 19.3.5 does not close it and 19.3.6 does. The scores below are GitLab's CVSS 3.1.

Also in this release #

• 19.5.4, 19.4.6, 19.3.8: the system CA bundle for gRPC default roots; gocloud.dev v0.47.0 for the S3-compatible backup sink; no new migrations.
• 19.5.3 and 19.4.5: Ruby ISEQ and imemo_env Copy-on-Write GC fixes for Ruby 3.3; the Orbit feature backports reverted.
• 19.5.3 and 19.4.5: denylist filters for instance audit event streaming.
• 19.5.3, 19.4.5 and 19.3.7: nested Jira request URLs built from the configured API URL.
• 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.14: gitlab-markup 2.2.0 and rdoc 8.1.0.
• 19.5.1, 19.4.3, 19.3.6: Workhorse returns 429 when Gitaly rejects GetArchive with ResourceExhausted.
• 19.4.3 and 19.3.6: Workhorse strips the trusted flag from client-supplied MCP tools.
• 19.3.6 and 19.2.9: Prometheus 3.13.2.
• 19.1.9: gitlab-shell 14.56.1 with a gitlab-sshd CPU spin fix, PostgreSQL 17.11 and Consul 1.22.7.
• 19.3.5: fixes the 19.3.4 bug on merge request pages with the Ona integration enabled; an application setting to block JWT for reclaimed project paths.
• 19.4.2: tzdata and tzdata-legacy installed in gitlab-base.

The 19.5.4 page and the earlier patch pages list every backport per line.

Upgrading Self-Managed GitLab, Runners and the AI Gateway #

1. Install the target for your line from the first table: 19.5.4, 19.4.6 or 19.3.8. From 19.2 or older, move to 19.3.8 or later, because no release on those lines fixes CVE-2026-105437 or the October 21 fixes other than CVE-2026-110264.
2. Plan for migrations: 19.5.3, 19.4.5, 19.4.3 and 19.3.6 include regular migrations, and a single-node instance has downtime until they complete; 19.5.4, 19.4.6 and 19.3.8 add no new migrations. Multi-node instances can use the zero-downtime upgrade procedure.
3. On a self-compiled installation or a custom image with its own Ruby, upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later for CVE-2026-110264.
4. On a self-compiled installation, rebuild Gitaly's Git through the Update Gitaly steps and the Git at git.bin_path from the matching Gitaly stable branch; a distribution Git needs 2.56.1 or later, or the distribution's patch for CVE-2026-105437.
5. Update self-hosted GitLab Runner to 19.5.1 and rebuild CI/CD job images that ship their own ca-certificates package.
6. Update a self-hosted AI Gateway to 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3 or later.
7. Watch the threat detections GitLab published for the three critical flaws, listed in the next section.

Checking a GitLab Instance: Version, Ruby, Git and Detections #

An instance is exposed when its version is below the target for its line in the first table. GitLab.com runs the patched versions, and GitLab Dedicated tenants need no action for the November 10 fix; on Dedicated, the October 21 fixes are in 19.3.5-internal0 and 19.4.2-internal0 or later. A self-compiled installation also needs the Ruby and Git versions from the steps above, and self-hosted runners need 19.5.1:

# Self-compiled GitLab: the Ruby that runs it (3.3.13, 3.4.12, 4.0.9 or later)
ruby -v
# The Git named in git.bin_path; run that binary with --version (a distribution Git: 2.56.1 or later)
grep -n "bin_path" config/gitlab.yml
# Self-hosted GitLab Runner: 19.5.1 or later
gitlab-runner --version

Each patch page lists GitLab's threat detections for self-managed instances, and each name links to its detection rule. For CVE-2026-97229 the 19.4.2 page lists six under "Detecting CVE-2026-97229 Exploitation Attempts": Onigmo native worker crash, Graphql cilint hostile regexp, ci regexp oversized non ascii path, ci regexp guard rejection, ci lint workhorse worker crash and ci lint scripted client error burst. For CVE-2026-110264 the 19.5.1 page lists Onigmo native worker crash and Org mode render error burst, and for CVE-2026-105437 the 19.5.4 page lists Git merge-tree child process crash.